Ship binaries and packages for every platform #10

Today the agent ships only as a Linux container image (amd64, arm64) or through go install. A Windows host without Go has no real way to install it, even though the README says Windows is supported.

• Release signed binaries with checksums for linux (amd64, arm64, armv7, 386), windows (amd64, arm64), darwin and freebsd.
• deb and rpm packages, and a Windows service (MSI or install-service).
• Reloads that work without systemd (OpenRC, SysV), plus a generic "run this command" reload.
• A run-once mode for hosts where a resident daemon isn't allowed, to run from cron or Task Scheduler.
• Check whether the HTTP client honours HTTPS_PROXY, and test it.
• A docs page, "When the agent can't run", listing each case and its fallback.

Part of certpilot/certpilot#139.