wazuh-agent-auth: a standalone token consumer

Component: client-agent Depends on: #39062, #39063 Rough size: L

Description

Objective requirement 11. This is a new binary, not a flag on an existing one — there is none in client-agent/ on this branch.

The 2026-09-11 decision that the token is the only registration path makes this the only post-install enrollment mechanism there is. With every address and credential variable removed, an agent that is already deployed — or one being re-pointed at a different manager, or one whose token expired before it first enrolled — has no installer run left to carry a token. Without this binary the only route is hand-editing ossec.conf, which is the defect §3.6 exists to complain about. It moves from "convenient" to "required".

Tasks

• A new binary that enrolls, re-enrolls, or moves an already-installed agent to another manager with one command.
• The token is read from a file or standard input, never from argv. ps output is world-readable and an argument lands in shell history — a token carrying a credential must not reach either.
• --show-token prints adr, ver and the pin as 64 lowercase hex characters — or, for an embedded token, the ca subject, issuer and validity — and never key. Match the manager CLI's existing --show-token[=<token>] [--token-file <path>], including reading from stdin, rather than inventing a second output shape for the same data.
• Runs as root, which is what lets it write the anchor per #39060.

Definition of Done

• An installed agent is moved to a different manager with one command and no file editing.
• The token never appears in ps output or shell history; a --token argument form does not exist.
• --show-token never prints the credential, covered by a test.

Related: #38940, #39021