feat(node-agent): production ops kit — Windows service + WireGuard mesh

config:
- LoadEnvFile(): reads agent.env beside the exe (or $AGENT_ENV_FILE) before env,
  so the sc.exe service needs no per-service environment plumbing; real env wins

deploy/ (new):
- build-windows.ps1     cross-compile → dist\ + stage the deploy kit
- agent.env.example     fully documented config template
- install-service.ps1   register as auto-start Windows service (native sc.exe),
                        crash-restart 3×/5s, no NSSM dependency
- uninstall-service.ps1 stop + remove
- wireguard-node.conf.template + setup-wireguard.ps1  node dials out only, no
                        public IP / inbound rules; tunnel installed as boot service
- README.md             full control-plane + node walkthrough, ops table, troubleshooting

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/node-agent/deploy/build-windows.ps1

@@ -0,0 +1,47 @@
+<#
+.SYNOPSIS
+  Cross-compile the FlatRender Node Agent to a Windows .exe.
+
+.DESCRIPTION
+  Produces dist\flatrender-node-agent.exe and stages agent.env.example + the
+  deploy scripts alongside it, ready to copy to a render node.
+
+  Requires Go 1.25+ installed locally (works on Windows, macOS, or Linux).
+
+.EXAMPLE
+  .\build-windows.ps1
+#>
+param(
+  [string]$OutDir = (Join-Path $PSScriptRoot "dist")
+)
+
+$ErrorActionPreference = "Stop"
+$agentRoot = (Resolve-Path (Join-Path $PSScriptRoot "..")).Path
+
+New-Item -ItemType Directory -Force -Path $OutDir | Out-Null
+$exe = Join-Path $OutDir "flatrender-node-agent.exe"
+
+Write-Host "Building Windows binary from $agentRoot ..."
+$env:GOOS = "windows"
+$env:GOARCH = "amd64"
+$env:CGO_ENABLED = "0"
+Push-Location $agentRoot
+try {
+  & go build -trimpath -ldflags="-s -w" -o $exe ./cmd/agent
+  if ($LASTEXITCODE -ne 0) { throw "go build failed ($LASTEXITCODE)" }
+} finally {
+  Pop-Location
+}
+
+# Stage the deploy kit next to the exe
+Copy-Item (Join-Path $PSScriptRoot "agent.env.example")            $OutDir -Force
+Copy-Item (Join-Path $PSScriptRoot "install-service.ps1")         $OutDir -Force
+Copy-Item (Join-Path $PSScriptRoot "uninstall-service.ps1")       $OutDir -Force
+Copy-Item (Join-Path $PSScriptRoot "setup-wireguard.ps1")         $OutDir -Force
+Copy-Item (Join-Path $PSScriptRoot "wireguard-node.conf.template") $OutDir -Force
+Copy-Item (Join-Path $PSScriptRoot "README.md")                   $OutDir -Force
+
+Write-Host ""
+Write-Host "✓ Built: $exe" -ForegroundColor Green
+Write-Host "  Deploy kit staged in: $OutDir"
+Write-Host "  Copy that folder to each render node, then follow README.md."