agent: P2-16 Windows service (SCM) integration

internal/agent/service: build-tagged into service_windows.go (svc.Handler
that listens for Stop/Shutdown + delegates to the agent loop) and
service_other.go (foreground stub for Linux/macOS). install_windows.go
wraps mgr.Connect+CreateService/Delete/Start/Stop for the new
'restic-manager-agent install|uninstall|start|stop' subcommands.

Cross-compile verified: GOOS=windows GOARCH=amd64 go build ./cmd/agent
succeeds. UNTESTED on Windows itself — the SCM round-trip can't be
exercised from Linux CI; treat as a starting point for the first
real Windows install.

internal/agent/service/service_other.go

@@ -0,0 +1,44 @@
+//go:build !windows
+
+// service_other.go — non-Windows fallback for the service package.
+// Linux uses systemd to wrap the agent; the binary itself just runs
+// in the foreground. Run() therefore just executes the agent loop
+// and returns. install/uninstall sub-commands return a clear error
+// directing the operator at the install.sh + systemd unit shipped
+// in deploy/install/.
+package service
+
+import (
+	"context"
+	"errors"
+)
+
+// AgentRun is the function-pointer shape main passes in. Same shape
+// as the Windows variant so the call site is portable.
+type AgentRun func(ctx context.Context) error
+
+// Run executes the agent loop in the foreground; on Unix the
+// systemd unit (or whatever runs us) supplies the lifecycle.
+func Run(agentRun AgentRun) error {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	return agentRun(ctx)
+}
+
+// Install registers the agent as a service. Windows-only; on Unix
+// the systemd unit covers this — returns an error pointing there.
+func Install() error { return errUnsupported("install") }
+
+// Uninstall is the inverse of Install. Windows-only.
+func Uninstall() error { return errUnsupported("uninstall") }
+
+// Start asks the OS service manager to start the installed service.
+// Windows-only.
+func Start() error { return errUnsupported("start") }
+
+// Stop sends a stop signal to the installed service. Windows-only.
+func Stop() error { return errUnsupported("stop") }
+
+func errUnsupported(verb string) error {
+	return errors.New("service " + verb + " is Windows-only; use the systemd unit on Linux")
+}