feat(agent)!: expose active package policy (#1937)

Exposes the validated active package-broker policy through the
authenticated `GET /v1/policy` route. Clients receive a stable snapshot,
while an unavailable policy returns the shared structured 404 response
without exposing policy source or file-security details.

Uses the official `now-policy` 0.3.0, `now-policy-api` 0.4.0, and
`now-policy-server-template` 0.4.0 releases. Phase 1 remains read-only:
policy management, validation, and replacement routes are not exposed.

Package policy files are now JSON-only. Deployments using `.yaml` or
`.yml` policy files must convert them to `.json`; unsupported extensions
and YAML content are rejected rather than silently parsed.

Coordinated stack: Devolutions/now-libraries#93 defines the shared
contract, this PR implements the Agent endpoint, and
Devolutions/UniGetUI#5292 consumes it. Keep this PR open while Phase 2
#1963 is restacked and the full stack is finalized.

BREAKING CHANGE: Package broker policy files must use JSON; YAML and YML
are no longer discovered or parsed.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: CBenoit

.github/workflows/ci.yml

@@ -1270,6 +1270,65 @@ jobs:
           psexec -accepteula -s pwsh.exe $scriptPath
           Get-Content -Path ./crates/pedm-simulator/pedm-simulator_run-expect-elevation.out
 
+  agent-policy-e2e:
+    name: Agent policy end-to-end test
+    runs-on: windows-2022
+    needs: [preflight]
+
+    steps:
+      - name: Checkout ${{ github.repository }}
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.preflight.outputs.ref }}
+
+      - name: Setup Rust cache
+        uses: ./.github/actions/setup-rust-cache
+        with:
+          sccache-enabled: ${{ needs.preflight.outputs.sccache }}
+
+      # Keep this installation aligned with the PEDM simulator job.
+      - name: Install PsExec
+        shell: pwsh
+        run: |
+          $expectedHash = '4F49964CC9CBAC2B5D87BDC8F9526012E9C4B243D8B7D0C0BB51F254A721CA2E'
+          $zipPath = Join-Path $env:RUNNER_TEMP 'PSTools.zip'
+          $toolsDir = Join-Path $env:RUNNER_TEMP 'PSTools'
+          Invoke-WebRequest -Uri 'https://download.sysinternals.com/files/PSTools.zip' -OutFile $zipPath
+          $actualHash = (Get-FileHash -Path $zipPath -Algorithm SHA256).Hash
+          if ($actualHash -ne $expectedHash) {
+            throw "PSTools.zip checksum mismatch: expected $expectedHash, got $actualHash"
+          }
+          Expand-Archive -Path $zipPath -DestinationPath $toolsDir
+          Add-Content -Path $env:GITHUB_PATH -Value $toolsDir
+
+      - name: Build Agent policy test executables
+        shell: pwsh
+        run: |
+          cargo build --locked -p devolutions-agent --features dev-skip-broker-signature
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+          cargo build --locked -p agent-policy-tester
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+
+      - name: Run Agent policy tester as LocalSystem
+        shell: pwsh
+        run: |
+          $scriptPath = Resolve-Path -Path "./crates/agent-policy-tester/run-as-system.ps1"
+          psexec -accepteula -s pwsh.exe -NoProfile -File $scriptPath
+          $exitCode = $LASTEXITCODE
+          Get-Content -Path ./crates/agent-policy-tester/agent-policy-tester.out
+          if ($exitCode -ne 0) {
+            exit $exitCode
+          }
+
+      - name: Show sccache stats
+        if: ${{ needs.preflight.outputs.sccache == 'true' && !cancelled() }}
+        shell: pwsh
+        run: sccache --show-stats
+
   secure-memory-verifier:
     name: secure-memory-verifier
     runs-on: windows-2022
@@ -1298,7 +1357,7 @@ jobs:
   success:
     name: Success
     if: ${{ always() }}
-    needs: [tests, agent-tunnel-e2e, lints, check-dependencies, jetsocat-lipo, devolutions-gateway-powershell, devolutions-gateway, devolutions-gateway-merge, devolutions-pedm-desktop, devolutions-agent, devolutions-agent-merge, devolutions-pedm-client, dotnet-utils-tests, winapi-sanitizer-tests, winapi-miri, pedm-simulator, secure-memory-verifier]
+    needs: [tests, agent-tunnel-e2e, agent-policy-e2e, lints, check-dependencies, jetsocat-lipo, devolutions-gateway-powershell, devolutions-gateway, devolutions-gateway-merge, devolutions-pedm-desktop, devolutions-agent, devolutions-agent-merge, devolutions-pedm-client, dotnet-utils-tests, winapi-sanitizer-tests, winapi-miri, pedm-simulator, secure-memory-verifier]
     runs-on: ubuntu-latest
 
     steps: