Backlog/v12 add forwarder in agentmanager

[yllada]

Closes #2262

Summary

• Add FORWARDER to CollectorModule enum in collector.proto
• Add FORWARDER constant to models/collector.go
• Regenerate all agent-manager proto files
• Replace agent gRPC pb files in forwarder with collector pb files
• Update register.go to use CollectorServiceClient and CollectorModule_FORWARDER

Changes

File	Change
agent-manager/protos/collector.proto	Add FORWARDER = 2 to enum
agent-manager/models/collector.go	Add FORWARDER constant
agent-manager/agent/*.pb.go	Regenerated with protoc
collectors/forwarder/upstream/register.go	Use CollectorServiceClient + CollectorModule_FORWARDER
collectors/forwarder/upstream/agent*.pb.go	Removed
collectors/forwarder/upstream/collector*.pb.go	Added (from collector.proto)

[github-actions]

🛑 AI review — Engineer review required

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. @Kbayero @osmontero please review.

🛑 architecture (gemini-3-flash-lite) — blocking — must fix before merge

Summary: Modification of gRPC contracts and agent-manager wire protocol (CollectorModule enum, RegisterCollector service) requires coordinated agent/server deployment.

• high agent-manager/protos/collector.proto:15 — Added CollectorModule_FORWARDER to enum. This changes the wire protocol and requires all existing agents/collectors to be updated to handle the new enum value, or the server will fail to deserialize requests from older clients.
• medium collectors/forwarder/upstream/register.go:45 — Changed registration logic from AgentRequest to RegisterRequest. This is a breaking change for the agent-manager API contract; ensure backend compatibility for older agents still using the old registration flow.
• low collectors/forwarder/cmd/install.go:37 — Added a mandatory network call (DownloadVersion) during installation. Ensure this does not block or fail the installer if the server is unreachable, as it introduces a new dependency on the server's availability during setup.

⚠️ bugs (gemini-3-flash-lite) — non-blocking warnings

Summary: Minor typo fixes in generated gRPC code and addition of collector registration logic.

• low agent-manager/agent/agent_grpc.pb.go:162 — Typo: "pancis" → "panics"
• low agent-manager/agent/agent_grpc.pb.go:401 — Typo: "pancis" → "panics"
• low agent-manager/agent/collector_grpc.pb.go:130 — Typo: "pancis" → "panics"
• low agent-manager/agent/ping_grpc.pb.go:82 — Typo: "pancis" → "panics"
• low collectors/forwarder/upstream/collector_grpc.pb.go:154 — Typo: "pancis" → "panics"

🛑 security (gemini-3-flash-lite) — blocking — must fix before merge

Summary: Changes to gRPC service definitions and collector registration logic, including new file I/O and network operations.

• medium collectors/forwarder/cmd/install.go:37 — The application performs a network download of 'version.json' and then parses it. Ensure the downloaded file is validated for integrity and that the path handling in 'updates.DownloadVersion' prevents potential path traversal or overwriting of critical system files.
• medium collectors/forwarder/listeners/auth.go:92 — The use of 'os.MkdirAll(dir, 0700)' and 'os.WriteFile(path, ..., 0600)' is good, but ensure the 'path' variable is strictly controlled and not susceptible to user-controlled input to prevent arbitrary file write vulnerabilities.

[utmstackprapprover]

Changes requested — Go dependencies check failed (see above).

[utmstackprapprover]

Changes requested — Go dependencies check failed (see above).

[utmstackprapprover]

Changes requested — AI review found blocking issues (high/critical, or engineer review required). See above.

[utmstackprapprover]

Changes requested — AI review found blocking issues (high/critical, or engineer review required). See above.

[Kbayero]

pancis error form grpc library, not ours