refactor(agent): scanner orchestrator cleanup + kernel-enforcement wiring + hash-registry follow-ups

Scanner refactor:
- Move Name() onto each scanner; drop scanner_wrappers.go, registry.go,
  scanner_types.go and the duplicate scanner/docker.go (folded into
  orchestrator/docker_scanner.go)
- Add Name() to DNFScanner (was missing — broke orchestrator.Scanner)
- dnf_test.go coverage

Kernel enforcement (Tier 2 scaffold, wired into loop):
- agent/internal/kernel: enforcer, ebpf consumer, windows WDAC stub
- config.KernelEnforcementConfig + defaults/merge, wired in loop.go

Hash registry (Layer 1) follow-ups:
- client GetExpectedHash uses /api/v1/updates/verify-hash
- UpdateHandler takes config; computeAndStorePackageHash uses PublicURL

Server:
- Migration 041: update version_history status constraint
- docker reject path writes "ignored" (matches new constraint)
- queries/filter.go shared filter helper
- updates UI enhancements

README.md

@@ -5,9 +5,12 @@
 Cross-platform agents • Web dashboard • Hardware binding • Ed25519 signing • Supply-chain gates • Full error transparency
 
 ```
-v0.2.0.2 — May 2026
+v0.2.0.5 — May 2026 (pre-release)
 ```
 
+> **NOT YET OFFICIALLY RELEASED** — Tags do not imply stability. We're in flux.
+> Mass enrollment announcement coming soon. Use at your own risk.
+
 RedFlag runs in production homelabs and small operator environments today. It is not a beta with disclaimers; it is a working system that the maintainer also runs as their primary update-management plane. Releases are versioned, migrations are idempotent, and the security model is documented in the code, not in marketing copy.
 
 **What's new in v0.2.0.2:** upstream version-sync subsystem (Repology + endoflife.date adapters, periodic syncer, "Stack Drift" dashboard panel, full CRUD page); aggregated Attention panel surfacing offline agents, failed updates, EOL drift, and recent upstream movement; rate-limiting UI rewritten to the real backend; agent-management token selector that doesn't conflate registration tokens with the install command; idempotent installer that detects existing credentials and skips re-registration; two-axis revocation model locked in; supply-chain package-age gate (Shai-Hulud-class defense). [Full changelog](#-tldr-changelog-dont-trust-the-transport-layer) · [Update instructions](#updating).
@@ -102,6 +105,11 @@ curl -sfL https://your-server.com/install | sudo bash -s -- your-registration-to
 iwr https://your-server.com/install.ps1 | iex
 ```
 
+**macOS (curl):**
+```bash
+curl -sfL https://your-server.com/install | sudo bash -s -- your-registration-token
+```
+
 **Manual installation:**
 ```bash
 # Download agent binary
@@ -291,9 +299,9 @@ Remove-Item "C:\ProgramData\RedFlag\config.json"
 - Windows Winget detection occasionally misses packages (Windows API limitation)
 - Some Windows Updates may reappear after installation (known Windows Update quirk)
 - Limited mobile dashboard optimization (usable but not ideal)
-- No macOS agent support (Linux + Windows only)
 - No AUR, Snap, Flatpak, Homebrew scanner support
 - Frontend is functional but not polished — some pages need UX love
+- macOS agent binaries not yet signed (build paths enabled, awaiting binary)
 ---
 
 ## License