One-command PMG endpoint onboarding for SafeDep Cloud (Protect Developers)

Goal

As a developer invited into a SafeDep tenant, I can run a single command surfaced by the SafeDep app during onboarding and immediately have PMG protecting my machine, with my endpoint visible in the app. This is the "Protect your developers" path of the first-time experience, where the value a user sees is their own endpoint showing up in the Endpoint Hub shortly after running one command.

Part of the immediate-time-to-value onboarding effort. Related: safedep/app.safedep.io#807.

Context

In the onboarding drawer the app presents one copy-paste command. The developer runs it on their machine. From that point the app expects the endpoint to appear, with basic identity, and package guard events to start flowing into the tenant. The app does not walk the developer through separate install, login, and sync steps. It hands them one command and then waits for the endpoint to check in.

This issue captures what the frontend needs from safedep/cli for that to work. It does not prescribe how to implement it.

What the frontend needs

• One command, one outcome. A single invocation that the app can render, which results in PMG installed, active, authenticated to the intended tenant, and syncing events. No manual follow-up steps after it.
• Non-interactive. It has to work as a pasted one-liner. It should not block on prompts the developer cannot answer from what the app gave them.
• Tenant and credential carried by the command. The app needs to embed the target tenant identity and a credential so the endpoint reports into the correct tenant. The developer should not have to create or paste an API key by hand. Provisioning that credential is a backend concern tracked in app.safedep.io#807; what is needed here is that the CLI accepts and uses it in the one invocation.
• Endpoint becomes visible. After the command runs, the endpoint must appear in SafeDep Cloud / Endpoint Hub with enough identity for the app to display it, such as hostname, OS, and architecture, so onboarding can confirm the first endpoint synced.
• Event sync on by default. Package guard events should flow to the tenant after this command without a separate enable step.
• Safe to re-run. Running it more than once should not leave a broken or duplicated state.
• Distinguishable success and failure. The developer and the app both need to know whether it worked, so the app's "listening for your first endpoint" state can resolve rather than hang.

What done looks like from the frontend

The app shows a command. A developer on a fresh machine runs it. Within a short window the onboarding drawer moves from "listening for your first endpoint" to showing the endpoint with its host, OS, and architecture, and package guard events for that tenant begin to appear. The developer did nothing beyond running the one command.

Non-goals

• The backend credential provisioning flow, which lives in app.safedep.io#807.
• The onboarding UI, gating, and trial activation, which are product and frontend concerns.
• Implementation approach for the CLI itself.

No files, tests, or command entry points are named in the issue. Start by locating the CLI entry point and existing PMG installation, authentication, endpoint registration, and event-sync flows. Done means one non-interactive, repeatable command installs and authenticates PMG, shows the endpoint with host, OS, and architecture, and starts tenant event sync with distinguishable success or failure.