Require signed agent releases (Refs #64)

tests/unit/native-hosts.test.ts

@@ -38,6 +38,13 @@ async function enrolled() {
 }
 
 describe('native host enrollment and scoped authentication', () => {
+    it('enrolls with an independently obtained local installer and quotes the token', async () => {
+        const { installerCommand } = await import('../../src/lib/server/hosts/http.js');
+        expect(installerCommand('https://controller.example/hosts/new', "token'quote")).toBe(
+            "sudo bash ./electric-cherry-install.sh --controller 'https://controller.example' --token 'token'\\''quote'"
+        );
+    });
+
     it.each(['instance.inspect', 'rcon.status-batch'])(
         'expires undelivered %s on timeout and delivers the next fresh check',
         async (kind) => {