fix(multitenancy): CU-86akb83pw: Reduce agent distributed_interval from 60 to 10 sec

[oleksandrd-flamingo]

CU-86akb83pw

Under multitenancy tenants served no agent options, so hosts fell back to osquery's defaults — distributed_interval 60s instead of 10s, making live queries and refetch slow. Two causes: upstream auto-applies its GitOps starter library after POST /setup and its template declares no agent_options, so the declarative apply nulls what setup just wrote; and OpenframeDefaultAppConfig() dropped agent options entirely after CU-86ah5x16c (a served logger_tls_endpoint broke log delivery, so the whole block was nulled).

Changes

• Skip the starter library application (same shape as upstream's Primo skip).
• Seed upstream's new-install agent options, trimmed of endpoint/plugin keys (logger_tls_endpoint, *_plugin, *_tls_*_endpoint) — those only override orbit's command-line wiring; intervals, attempts, pack_delimiter and decorators are kept. Trimming at the source covers all consumers of the defaults: tenant seeding in EnsureOpenframeTeamID, the missing-row read fallback, and the instance-row migration.

Both gated on FLEET_OPENFRAME_MULTI_TENANCY_ENABLED, so non-multitenant deployments keep upstream behavior byte for byte. Agent config reads are team-pinned, so a host is served its tenant's (trimmed) row; POST /setup still writes upstream's untrimmed defaults to the unpinned instance row (id = 1), read only by crons and boot.

Existing instances are deliberately left untouched: rows wiped before this change keep serving no agent options until re-applied per tenant.

Tests: trim + defaults unit tests, MySQL-backed tenant-seeding assertions (MYSQL_TEST=1, green).

No API changes

Backward compatible in both rollout directions

🤖 Generated with Claude Code