fix(installer): silent install kept empty server_url; tray now starts; self-update uses GitHub releases

Fresh-install bug report fixes:

- Silent installs wrote server_url: '' -- CurPageChanged fires even when the
  wizard is walked programmatically in silent mode, so it read the empty edit
  boxes and clobbered the /SERVER_URL /JOIN_KEY command-line params. Guard the
  read with WizardSilent() so silent installs keep the params and interactive
  installs keep the wizard values. (This is also why the service exited on
  first connect and the Directory showed the agent as 'v2.0.0': the agent never
  connected, so the server fell back to its placeholder version.)
- The tray post-install launch had skipifsilent, so a silent install (the
  common path from the Directory's Windows command) never started the tray.
  Removed it -- the tray starts in silent installs too.
- theta-agent update (cli.go) downloaded from the SSO /resources path, which no
  longer serves binaries (they are GitHub release artifacts now) -- 404.
  Pointed it at releases/latest/download via releaseAssetURL.

cli.go

@@ -72,12 +72,10 @@ func runSelfUpdate(args []string) {
 	if err != nil {
 		log.Fatalf("[!] Update failed: cannot read config from %s: %v", configPath, err)
 	}
-	cfg := cm.Get()
+	_ = cm.Get()
-	serverURL := strings.TrimRight(cfg.ServerURL, "/")
-	if serverURL == "" {
-		log.Fatalf("[!] Update failed: server_url is empty in %s", configPath)
-	}
 
+	// Binaries are GitHub release artifacts (DESIGN-WINDOWS.md §9); nothing
+	// binary is served from the SSO's /resources anymore.
 	arch := "amd64"
 	if runtime.GOARCH == "arm64" {
 		arch = "arm64"
@@ -87,7 +85,7 @@ func runSelfUpdate(args []string) {
 		ext = ".exe"
 	}
 	artifact := fmt.Sprintf("theta-agent-%s-%s%s", runtime.GOOS, arch, ext)
-	downloadURL := fmt.Sprintf("%s/resources/theta-agent/%s", serverURL, artifact)
+	downloadURL := releaseAssetURL(artifact)
 	log.Printf("[+] Downloading latest Theta Agent binary from %s...", downloadURL)
 
 	client := &http.Client{Timeout: 30 * time.Second}
@@ -162,6 +160,13 @@ func runReinitialize(args []string) {
 	os.Exit(0)
 }
 
+// releaseAssetURL returns the GitHub release download URL for a theta-agent
+// artifact (e.g. "theta-agent-linux-amd64"). Binaries are built by CI and
+// attached to the release; nothing binary lives in the repos (DESIGN-WINDOWS.md §9).
+func releaseAssetURL(artifact string) string {
+	return "https://github.com/theta42/theta-agent/releases/latest/download/" + artifact
+}
+
 func restartAffectedServices(exec Executor) {
 	log.Printf("[+] Restarting theta-agent service...")
 	if runtime.GOOS == "windows" {

installer/windows/installer.iss

@@ -91,8 +91,10 @@ Filename: "msiexec.exe"; Parameters: "/i ""{app}\vendor\wireguard-amd64-0.5.3.ms
 Filename: "taskkill.exe"; Parameters: "/f /im wireguard.exe"; Flags: runhidden
 ; Register the agent as a SYSTEM auto-start service.
 Filename: "{app}\{#MyAppExeName}"; Parameters: "install-service"; StatusMsg: "Registering theta-agent service..."; Flags: runhidden waituntilterminated
-; Show the tray right away instead of waiting for the next logon.
+; Show the tray right away, in silent and interactive installs alike (a silent
-Filename: "{app}\tray\theta-agent-tray-windows-amd64.exe"; Description: "Start Theta Agent tray"; StatusMsg: "Starting Theta Agent tray..."; Flags: nowait postinstall skipifsilent
+; install is the common path from the Directory's install command, and the tray
+; should appear immediately there too, not only at the next logon).
+Filename: "{app}\tray\theta-agent-tray-windows-amd64.exe"; Description: "Start Theta Agent tray"; StatusMsg: "Starting Theta Agent tray..."; Flags: nowait postinstall
 
 [Code]
 var
@@ -206,11 +208,15 @@ begin
   CreateAgentConfigPage();
 end;
 
-// Pull the values the operator typed into the wizard so WriteAgentConfig can use
+// Pull the values the operator typed into the wizard so WriteAgentConfig can
-// them; silent installs keep the command-line params.
+// use them. In silent mode the wizard is walked programmatically and
+// CurPageChanged fires too -- reading the (empty) edit boxes there would wipe
+// the /SERVER_URL /JOIN_KEY command-line params and leave agent.yml with an
+// empty server_url. Only take the edit values when the wizard is actually
+// being shown interactively.
 procedure CurPageChanged(CurPageID: Integer);
 begin
-  if CurPageID = AgentConfigPage.ID then begin
+  if (CurPageID = AgentConfigPage.ID) and (not WizardSilent()) then begin
     ServerURL := Trim(ServerURLEdit.Text);
     JoinKey := Trim(JoinKeyEdit.Text);
   end;