baseline: P1 契约、agent 核心与中继投递（既有工作首次入库）

Makefile

@@ -0,0 +1,42 @@
+POLICY_SRC := ../contracts/agent-policy.json
+POLICY_DST := internal/policy/agent-policy.json
+VERSION    ?= 0.1.0
+LDFLAGS    := -s -w -X main.version=$(VERSION)
+
+.PHONY: all vendor test vet build build-arm64 build-armv7 clean
+
+all: vet test build
+
+# The policy is embedded, so the vendored copy is part of the binary. Keep the copy mechanical:
+# an operator editing internal/policy/agent-policy.json by hand would be editing a file the build
+# overwrites, and the drift test makes that mistake loud rather than quiet.
+vendor: $(POLICY_DST)
+
+$(POLICY_DST): $(POLICY_SRC)
+	@cp $(POLICY_SRC) $(POLICY_DST)
+
+test: vendor
+	@go test ./...
+
+vet: vendor
+	@go vet ./...
+
+fmt:
+	@gofmt -l -w .
+
+build: vendor
+	@mkdir -p dist
+	@go build -trimpath -ldflags '$(LDFLAGS)' -o dist/msa-agent ./cmd/msa-agent
+
+# Nodes are ARM Debian boxes that also run SimAdmin, so the static binary is copied in rather than
+# installed through a package manager: no runtime deps, no apt state, trivially removable.
+build-arm64: vendor
+	@mkdir -p dist
+	@CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -trimpath -ldflags '$(LDFLAGS)' -o dist/msa-agent-linux-arm64 ./cmd/msa-agent
+
+build-armv7: vendor
+	@mkdir -p dist
+	@CGO_ENABLED=0 GOOS=linux GOARCH=arm GOARM=7 go build -trimpath -ldflags '$(LDFLAGS)' -o dist/msa-agent-linux-armv7 ./cmd/msa-agent
+
+clean:
+	@rm -rf dist