Agent Tunnel: installer reports success on enrollment, not on tunnel connectivity

[irvingouj@Devolutions (irvingoujAtDevolution)]

Split out of #1831 (draft tracker — the TODO(agent-tunnel) marker is placed at the exact code site; not fixed yet).

Installer reports success on enrollment, not on tunnel connectivity

Symptom: MSI install shows the Agent Tunnel step as success, but the agent never appears online in the Gateway / DVLS agent list.

Root cause: EnrollAgentTunnel runs devolutions-agent up → enroll_agent() (devolutions-agent/src/enrollment.rs). Its success criteria is only:

1. POST https://<gw>:7171/jet/tunnel/enroll (HTTPS management port) returns 2xx and issues the client cert, and
2. the cert/key/CA + Tunnel section are persisted to agent.json.

The actual data path — the QUIC tunnel over UDP (quic_endpoint, 4433) — is established later by the agent service (devolutions_agent::tunnel, with auto-reconnect) and is never probed at install time. Enrollment uses 7171; the tunnel uses 4433. So when 4433 is blocked (e.g. firewall) the install is green while the agent silently fails to connect.

Reproduced: Gateway host firewall had no inbound UDP 4433 rule → agent log: Tunnel connection lost error=QUIC handshake: timed out → agent absent from GET /jet/tunnel/agents, yet the installer said success.

Suggested fix: after enroll_agent, do a short QUIC connectivity probe to enroll_response.quic_endpoint and surface a clear warning/failure when it can't connect (so admins get actionable feedback at install time). TODO(agent-tunnel) marker in enrollment.rs.

[github-actions]

Let maintainers know that an action is required on their side

• Add the label release-required Please cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module) when you request a maintainer to cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module)

• Add the label release-blocker Follow-up is required before cutting a new release if a follow-up is required before cutting a new release

• Add the label publish-required Please publish libraries (`Devolutions.Gateway.Utils`, OpenAPI clients, etc) when you request a maintainer to publish libraries (Devolutions.Gateway.Utils, OpenAPI clients, etc.)

• Add the label publish-blocker Follow-up is required before publishing libraries if a follow-up is required before publishing libraries