feat(siem): agent fixes from fleet pass; IPv6 kill script [#335][#748]

deploy-agent.sh now self-heals the three postinst failure modes found on
PMG/PBS hosts (MANAGER_IP placeholder, missing wazuh user, root:root
ownership). scripts/disable-ipv6.sh: live sysctl + persisted conf, with
in-file rollback notes. Rollout state in #335/#748.
Meat: https://projects.knownelement.com/issues/335#note-4008

siem/deploy-agent.sh

@@ -27,6 +27,16 @@ if ! grep -q "<address>$MGR</address>" "$CONF"; then
   sed -i "s|<address>[^<]*</address>|<address>$MGR</address>|" "$CONF"
 fi
 
+# Package robustness (learned on PMG/PBS hosts 2026-09-03): postinst can
+# leave the MANAGER_IP placeholder, a missing wazuh user, and root:root
+# ownership — all three break startup with misleading errors.
+id wazuh >/dev/null 2>&1 || useradd -r -d /var/ossec -s /usr/sbin/nologin wazuh
+sed -i "s|<address>MANAGER_IP</address>|<address>$MGR</address>|" "$CONF"
+chown -R root:wazuh /var/ossec 2>/dev/null || true
+chown -R wazuh:wazuh /var/ossec/queue /var/ossec/logs /var/ossec/etc 2>/dev/null || true
+chown root:wazuh /var/ossec/var/run 2>/dev/null || true
+chmod 770 /var/ossec/queue/sockets /var/ossec/var/run /var/ossec/etc 2>/dev/null || true
+
 systemctl enable wazuh-agent >/dev/null 2>&1 || true
 systemctl restart wazuh-agent
 sleep 8