feat(configgen): yaml.v3 typed-struct config marshal (closes #126)

[ak2k]

Summary

Closes #126. Replaces internal/configgen/generator.go's text/template-based agent config generator with typed-struct marshalling through gopkg.in/yaml.v3. Defense-in-depth follow-up to GHSA-7hp6 — closes the entire YAML-injection class at the output side regardless of what upstream validators allow.

Public API (GeneratorInput, FirewallRule, LighthouseInfo, AdvancedUnsafeRoute) unchanged; only the implementation moves.

Changes

internal/configgen/marshal.go (new): typed nebulaConfig struct mirroring the previous template's shape. Inline PEM blocks use a literalString MarshalYAML to produce the | literal-block scalar form.

internal/configgen/generator.go: configTemplate, indentLines, and the template-based Generate are removed. Only public input types remain.

internal/configgen/generator_test.go:

• Three multi-address tests (StaticHostMap_PerAddress, LighthouseHosts_AllAddresses, MultipleLighthousesEachMulti) converted from byte-equality on flow-style + quoted IPs to parse-then-compare via yaml.Unmarshal, per the suggestion in your issue body.
• Added TestGenerate_LighthouseAndRelay covering the lighthouse+relay combo (both am_lighthouse: true and am_relay: true).
• TestGenerate_Lighthouse now also asserts that static_host_map: {} is emitted explicitly — locks down the empty contract against a future omitempty refactor silently dropping the key.

internal/configgen/advanced_test.go: TestGenerate_TunDevice_StructuralBreakCharsAreQuoted (new) is the defense-in-depth acceptance criterion. A TunDevice value containing \r, \n, ENQ (0x05), \", :, #, or trailing whitespace round-trips through yaml.Unmarshal exactly, with no extra top-level keys appearing in the output (which would indicate YAML injection). Seven sub-cases, all pass.

Mobile bundle path (internal/mobilebundle/builder.go) uses the same GeneratorInput — no API change needed there.

Acceptance vs your issue body

Item	Status
New `marshal.go` with typed struct + `Generate`	✅
Delete `configTemplate`, `indentLines`, `template.FuncMap`	✅
Update `advanced_test.go` + `generator_test.go` for parse-then-compare	✅
Mobile bundle path: no API change	✅
All existing `configgen` tests pass	✅
Defense-in-depth test: TunDevice with `\r`, `\x05`, `"`, `:`, `#` round-trips as safe quoted scalar	✅

Pre-flight

`make ci` green: vet, build, race tests, golangci-lint v2.12.0 (`0 issues.`). All existing configgen tests pass + the new `LighthouseAndRelay` test + the 7-case defense-in-depth subtest.