[javuto]

Move the Santa sync server to the stable v1 protos

Closes #1184

Problem

osctrl's Santa sync server was built on syncv2 from buf.build/gen/go/northpolesec/protos. North Pole Security has said that v2 is their internal protocol, "not supported for external users", and that they are removing it from the published protos (northpolesec/santa#1270). After that, the next update of the protos dependency will break osctrl's build. v1 is the stable protocol for third-party sync servers. North Pole Security will list osctrl as a sync server in the Santa docs once it uses v1.

Change

• In pkg/santa/sync.go and cmd/tls/handlers/santa.go, plus their tests, switch the import from .../protocolbuffers/go/syncv2 to .../protocolbuffers/go/sync (package syncv1).
• pkg/santa/README.md: the endpoint now says it serves Santa sync protocol v1.

No behaviour changes for Santa clients. They already talk v1 to osctrl, and osctrl used no v2-only fields. go.mod is unchanged because v1 and v2 come from the same module.

Compatibility

• Stored data: v1 and v2 share the same enum names and numbers for everything osctrl stores (SyncType, ClientMode, Policy, RuleType, Decision), so existing rules, modes and pending sync types need no migration.
• v2-only enum values: two no longer exist. The SEATBELT policy was never offered in the UI and is now rejected by the API. The CEL-fallback decisions (ALLOW_CEL_FALLBACK, BLOCK_CEL_FALLBACK) are not sent by v1 clients.

Security / operational impact

None. Auth (X-Osctrl-Santa-Token), body limits, UUID validation and node/environment ownership checks are untouched.

Validation

• go build ./...
• go vet ./pkg/santa ./cmd/tls/...
• go test ./pkg/santa/... ./cmd/tls/... pass
• grep -r syncv2 pkg cmd is empty
• Not yet verified with a stock Santa client running a full sync against this build

Follow-up

After release, reply on northpolesec/santa#1270 so osctrl can be listed as a sync server.