feat(sight): add component-owned raw packaging

[ikunkun-sys]

Why

AgentSight needs a component-owned raw packaging interface so release tooling can consume immutable artifacts without duplicating Linux and macOS payload assembly. The contracts follow the actual build boundary: Linux ships full tracing and enforcement, while macOS ships trajectory and viewer functionality only.

What changed

• Add deterministic stage and package entrypoints for AgentSight raw archives.
• Support Linux x86_64 and macOS aarch64 with separate target contracts.
• Include agentsight-enforcer, launch script, and services only in the Linux payload.
• Validate contract versions, target binary formats, and hash-bound cross-build metadata.
• Add fixture tests, version-sync checks, and CI coverage for the packaging interface.

Related issue

Related: #2547 documents the CLI dry-run sidecar metadata limitation. This packaging PR follows that target-specific metadata direction but intentionally does not close the CLI issue.

User / Agent impact

Release tooling can invoke make package-raw or make stage-raw for:

• agentsight-0.10.1-linux-x86_64.tar.gz
• agentsight-0.10.1-macos-aarch64.tar.gz

Linux packages contain AgentSight, the enforcer, launch script, and service units. macOS packages contain only the AgentSight binary and contract; enforcement remains unsupported there. Cross-target packaging requires agentsight-build.toml with the target identity and binary SHA-256 values.

Risk and compatibility

• Public CLI, API, configuration, or documented behavior changed
• Privileged or security-sensitive behavior changed
• Cross-component contract changed
• Migration or rollback guidance is needed

The Linux contract declares the existing optional eBPF capabilities and system services. The macOS contract has no capabilities, services, or enforcer. Existing source and RPM installation paths are unchanged, and release-pipeline integration remains outside this PR.

Validation

Passed:

• bash src/agentsight/scripts/test-package-raw.sh
• python3 scripts/check-component-versions.py
• shellcheck src/agentsight/packaging/raw/package.sh src/agentsight/scripts/test-package-raw.sh
• cargo fmt --all -- --check
• cargo test --quiet --workspace --tests -- --skip test_try_match_process_current
• git diff --check origin/main...HEAD
• Real Linux x86_64 Cross build with Rust 1.93 and glibc 2.28 compatibility; both agentsight and the real ActPlane agentsight-enforcer were packaged.
• Real macOS aarch64 Cross build; the Mach-O arm64 binary targets macOS 11.0 and the package contains no enforcer.
• Both real archives were imported into one temporary registry and validated as one AgentSight catalog identity.

Known baseline failures outside this diff:

• cargo clippy --workspace --all-targets -- -D warnings on Rust 1.97 reports clippy::question_mark in src/analyzer/message/openai.rs:99.
• Full cargo test --workspace reports the existing test_try_match_process_current failure and a malformed rustdoc fence in src/genai/helpers.rs:504. All non-doctest workspace tests pass when the process-discovery test is skipped.

Documentation and rollback

No documentation changed. Revert commit 4eb25aa6 to remove the component-owned raw packaging interface and contracts.