fix: Atera bundled MSI, remove --resume flag, CI CGo+MinGW

Atera agent: download URL requires MFA in browser session, so
Invoke-WebRequest gets HTML instead of MSI. Changed to bundled
MSI from assets/Atera/ - download once from dashboard, no network
dependency. Graceful skip with log message when MSI not present.

Removed unused --resume argument from X9-Resume scheduled task
registration. Resume is detected via state file, not CLI flag.

CI pipeline: added mingw-w64-gcc and CGO_ENABLED=1 for Walk
cross-compilation (required since Walk migration from Fyne).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Setup
         working-directory: /
         run: |
-          apk add --no-cache git curl jq
+          apk add --no-cache git curl jq mingw-w64-gcc
           git clone --depth=1 \
             "http://x9:${{ secrets.FORGEJO_TOKEN }}@xetup-forgejo:3000/${{ github.repository }}.git" \
             /repo
@@ -41,6 +41,7 @@ jobs:
 
       - name: Build xetup.exe
         run: |
+          CGO_ENABLED=1 CC=x86_64-w64-mingw32-gcc \
             GOOS=windows GOARCH=amd64 \
             go build -ldflags="-s -w -H windowsgui" -o xetup.exe ./cmd/xetup/
           echo "Built: $(ls -lh xetup.exe | awk '{print $5}')"

internal/prereboot/prereboot_windows.go

@@ -158,8 +158,9 @@ func disableAutologon() error {
 }
 
 func registerResumeTask() error {
+	// No arguments needed - xetup detects resume mode via state file presence.
 	ps := fmt.Sprintf(`
-$action    = New-ScheduledTaskAction -Execute '%s' -Argument '--resume'
+$action    = New-ScheduledTaskAction -Execute '%s'
 $trigger   = New-ScheduledTaskTrigger -AtLogOn -User '%s'
 $settings  = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Hours 4) -MultipleInstances IgnoreNew
 $principal = New-ScheduledTaskPrincipal -UserId '%s' -LogonType Interactive -RunLevel Highest

scripts/02-software.ps1

@@ -185,19 +185,27 @@ if (Get-Feature $Config "software" "pdfDefault") {
 
 # -----------------------------------------------------------------------
 # Install Atera RMM Agent
+# The MSI is bundled in assets/Atera/ (downloaded once from the Atera
+# dashboard). The download URL requires MFA in a browser session, so
+# Invoke-WebRequest gets an HTML login page instead of the MSI binary.
+# Bundling avoids this entirely - no network dependency for Atera.
+# To update: download fresh MSI from Atera dashboard, replace in assets/.
 # -----------------------------------------------------------------------
 if (Get-Feature $Config "software" "ateraAgent") {
     Write-Log "Installing Atera RMM Agent" -Level INFO
 
-    $ateraUrl = "https://x9.servicedesk.atera.com/api/utils/agent-install/windows/?cid=31&aeid=50b72e7113e54a63ac76b96c54c7e337"
-    $ateraMsi = "$env:TEMP\AteraAgent.msi"
+    # Look for bundled MSI in assets/Atera/
+    $ateraAssetsDir = Join-Path $PSScriptRoot "..\assets\Atera"
+    $ateraMsi = Get-ChildItem -Path $ateraAssetsDir -Filter "*.msi" -ErrorAction SilentlyContinue |
+                Select-Object -First 1
 
+    if (-not $ateraMsi) {
+        Write-Log "  No Atera MSI found in assets/Atera/ - skipping" -Level WARN
+        Write-Log "  Download MSI from Atera dashboard and place in assets/Atera/" -Level WARN
+    } else {
+        Write-Log "  Using bundled MSI: $($ateraMsi.Name)" -Level INFO
         try {
-        Write-Log "  Downloading Atera agent..." -Level INFO
-        Invoke-WebRequest -Uri $ateraUrl -OutFile $ateraMsi -UseBasicParsing -ErrorAction Stop
-        Write-Log "  Download complete" -Level OK
-
-        $msiProc = Start-Process msiexec -ArgumentList "/i `"$ateraMsi`" /qn" -Wait -PassThru
+            $msiProc = Start-Process msiexec -ArgumentList "/i `"$($ateraMsi.FullName)`" /qn" -Wait -PassThru
             if ($msiProc.ExitCode -eq 0) {
                 Write-Log "  Atera agent installed (msiexec exit 0)" -Level OK
             } else {
@@ -214,10 +222,8 @@ if (Get-Feature $Config "software" "ateraAgent") {
             }
         }
         catch {
-        Write-Log "  Atera agent download/install failed: $_" -Level ERROR
+            Write-Log "  Atera agent install failed: $_" -Level ERROR
         }
-    finally {
-        Remove-Item $ateraMsi -Force -ErrorAction SilentlyContinue
     }
 } else {
     Write-Log "ateraAgent feature disabled - skipping" -Level INFO