NM-304: collect additional data for MDM integration

[abhishek9686]

Describe your changes

Provide Issue ticket number if applicable/not in title

Provide link to Netmaker PR if required

Provide testing steps

Checklist before requesting a review

• My changes affect only 10 files or less.
• I have performed a self-review of my code and tested it.
• If it is a new feature, I have added thorough tests, my code is <= 1450 lines.
• If it is a bugfix, my code is <= 200 lines.
• My functions are <= 80 lines.
• I have had my code reviewed by a peer.
• My unit tests pass locally.
• Netclient & Netmaker are awesome.

[tenki-reviewer]

Review Complete

Files Reviewed: 29
Findings: 6

By Severity:

• 🟠 High: 2
• 🟡 Medium: 3
• 🟢 Low: 1

---

This PR introduces cross-platform device identity collection (Linux, Windows, macOS) and MDM compliance posture handling. Review found 2 high-severity bugs (unbounded external command execution blocking the SYSTEM service, and computer UPNs bypassing machine account filters) plus 3 medium-severity identity bugs (DMI placeholders, sentinel UUIDs, day-count truncation) and 1 low-severity error-wrapping contract violation.

Files Reviewed (29 files)

auth/mdm.go
auth/mdm_test.go
cmd/posture.go
cmd/root.go
config/config.go
functions/host_identity.go
functions/mqhandlers.go
functions/mqpublish.go
functions/posture.go
functions/pull.go
functions/register.go
functions/register_sso.go
go.mod
posture/apply.go
posture/client.go
posture/email.go
posture/email_test.go
posture/identity.go
posture/identity_darwin.go
posture/identity_darwin_test.go
posture/identity_linux.go
posture/identity_linux_test.go
posture/identity_other.go
posture/identity_registry_windows.go
posture/identity_test.go
posture/identity_windows.go
posture/identity_windows_test.go
posture/runner.go
posture/status.go

[tenki-reviewer]

Risk: 🟠 High (68/100) — 2 high findings, 3 medium, 1 low · 1400 LOC across 29 files

---

High Severity

• Unbounded external command timeouts (posture/runner.go:11): osRunner.Run uses exec.Command().Output() without context/timeout. On Windows SYSTEM service, hung PowerShell/dsregcmd/wmic blocks all netclient operations indefinitely. Requires interface change to exec.CommandContext with 15s timeout.
• Computer UPN misclassified as user email (posture/email.go:12): isMachineAccount only checks HasSuffix("$"), missing Azure AD computer UPNs like COMPUTERNAME$@tenant.onmicrosoft.com. Causes silent MDM matching failures when SYSTEM service reports machine identity as user email.

Medium Severity

• DMI placeholder strings treated as valid serial numbers (posture/identity_linux.go:6): firstNonEmpty accepts placeholders like "Not Specified" and "To be filled by O.E.M.", skipping the board_serial fallback.
• Sentinel UUIDs (nil/all-ones) unfiltered (posture/identity_windows.go:24): VM fleets without SMBIOS passthrough share the same sentinel UUID, causing device identity collisions.
• humanDuration truncates day values ending in 0 (functions/posture.go:138): TrimSuffix strips "0d" from any day value ending in 0 (10→1, 20→2, etc.).

Low Severity

• Error wrapping drops ErrStatusNotOk (auth/mdm.go:42): AsMDMDenied uses %w: %s instead of %w: %w, breaking the documented error chain contract.