fix(security): enforce valid agent authentication

[vrlda]

Summary

• reject unknown bearer tokens and bind heartbeat host IDs to per-host credentials
• require HTTPS for remote agent control planes; add security policy
• align binary metadata with v0.2.0

Validation

• cargo test --workspace
• cargo clippy --workspace --all-targets -- -D warnings
• cargo fmt --all --check
• bash -n scripts/*.sh
• installer URL behavior checks