[rohans2278]

Description
Adds Hybrid Public Key Encryption (HPKE) using X-Wing for Kolide Agent/Service messaging (currently using crypto_box/libsodium) to provide post-quantum security. Existing crypto_box code is unchanged.

How it works

1. K2 generates an X-Wing key pair and sends the public key with the signed challenge.
2. The Agent uses that public key to encrypt its response using HPKE.
3. K2 decrypts the response with its X-Wing private key, then checks the ECDSA signatures as before.

Libraries

• Agent: Go's standard library (crypto/hpke)
• K2: op-crypto-internal-hpke (exposed to Ruby as a gem)

Testing

• Go and Ruby unit tests: cover each side on its own, mirroring the existing crypto_box tests.
• Cross-language tests: run full round trips between Ruby and Go in both directions, including tampered messages and wrong keys.

Requires Ruby 3.2+, Rust, libsodium, and git access to agilebits-inc/crypto.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}