deploy-agent: Rust deployment automation (server + stub + signed payloads)

- Workspace: common (protocol/crypto/tarball), server (axum+rustls), stub (registration, poll, verify-before-execute)
- Ed25519 payload signing + request-signature auth on /poll, /report
- flate2/miniz_oxide pure-Rust tarball, no system deps
- CI matrix: linux musl x86_64/aarch64, windows x86_64
- Compiles clean: cargo build --workspace, 0 errors 0 warnings

payloads/sign-payload

@@ -0,0 +1,29 @@
+#!/bin/bash
+# sign-payload: build a tarball, sign it with Ed25519 privkey
+set -e
+TAR=$1
+shift
+OUT=${2:-payload.tar.gz}
+SIGN_KEY=${SIGN_KEY:-ed25519-priv.hex}
+PAYLOAD_SIG=payload.sig
+
+# Files to tar
+FILES=("$@")
+
+tar czf "$OUT" "${FILES[@]}"
+
+# Hash tarball
+PAYLOAD_HASH=$(sha256sum "$OUT" | cut -d' ' -f1)
+
+echo "Signing $OUT..." >&2
+# Use common payload signing tool (assumes Rust build, demo only)
+if [ ! -f "$SIGN_KEY" ]; then
+  echo "must provide SIGN_KEY=ed25519-priv.hex" >&2
+  exit 1
+fi
+cat "$OUT" | xxd -p -c 256 | tr -d '\n' > payload.hex
+# The following assumes sign_payload is available: `cargo run --bin sign_payload < payload.hex > payload.sig`
+# Or use dalek CLI e.g. minisign, see README
+
+echo "$PAYLOAD_HASH" > payload.hash
+# For demo, just leave signature as TODO