Add packaged DLP broker and protected Windows service foundation

apps/browser/main.cjs

@@ -102,6 +102,7 @@ let message='Enroll this browser to receive company policy.',syncTimer,localInsp
 const recentRequests=new Map();
 const agentFile=()=>path.join(app.getPath('userData'),'agent-connection.json');
 const agentGrants=require('./agent-grants.cjs');
+function protectAgentCapability(value){return diagnosticSpan('browser.credential',{operation:'credential.issue',component:'agent',bytes:Buffer.byteLength(value)},()=>require('./dpapi.cjs').capabilityCrypto('protect',value));}
 const agentActorStorage=new (require('node:async_hooks').AsyncLocalStorage)();
 let agentServiceMode;
 function effectiveAgentPolicy(){if(!policy)return policy;const {grants}=agentGrants.reconcileGenerationFloor(policy.agents.grants||[],device?.agentGenerationFloor||{});return {...policy,agents:{...policy.agents,grants}};}
@@ -121,7 +122,7 @@ async function pairIndividualAgent(principalId){
   const grant=approvedAgentGrants().find(g=>g.id===principalId),initial=policy,service=agentService;
   if(!grant||!service||agentServiceMode!=='individual')throw Error('Agent grant unavailable');
   const connection=service.issuePrincipal(grant.id,grant.generation,grant.expiresAt);
-  const credentialPath=await agentGrants.persistConnection({filePath:agentGrants.descriptorPath(app.getPath('userData'),grant.id),connection,protect:value=>require('./dpapi.cjs').capabilityCrypto('protect',value),isCurrent:()=>ready&&policy===initial&&agentService===service&&featureAllowed(managedSettings(),'agents')&&actorGrantAllowed({principalId:grant.id,generation:grant.generation},grant.scopes[0])});
+  const credentialPath=await agentGrants.persistConnection({filePath:agentGrants.descriptorPath(app.getPath('userData'),grant.id),connection,protect:protectAgentCapability,isCurrent:()=>ready&&policy===initial&&agentService===service&&featureAllowed(managedSettings(),'agents')&&actorGrantAllowed({principalId:grant.id,generation:grant.generation},grant.scopes[0])});
   return {address:service.address,credentialPath,principalId:grant.id,generation:grant.generation};
 }
 
@@ -457,7 +458,7 @@ async function ensureAgentAPI(){
         if(!checkURL(url))return {allowed:false};
         return {allowed:true,role:'agent',scopes:[scope]};
       },audit:auditAgent,
-      persistCredential:connection=>agentGrants.persistConnection({filePath:agentFile(),connection,protect:value=>require('./dpapi.cjs').capabilityCrypto('protect',value),isCurrent:()=>ready&&policy?.agents.identityMode==='legacy'&&policy.agents.enabled})
+      persistCredential:connection=>agentGrants.persistConnection({filePath:agentFile(),connection,protect:protectAgentCapability,isCurrent:()=>ready&&policy?.agents.identityMode==='legacy'&&policy.agents.enabled})
     });emit();
   }finally{agentStarting=false;}
 }