feat: validate single-client broadcast operations

node-agent/WxAgent.Service/ServiceOptions.cs

@@ -22,6 +22,9 @@ public sealed class ServiceOptions
     public RemoteAgentOptions? Remote { get; init; }
     public ReportingConfig Reporting { get; init; } = new();
     public string? RemoteConfigurationFile { get; init; }
+    // Explicitly opt-in for a single, user-authorized Windows validation session.
+    // Production deployments remain read-only unless this local gate is enabled.
+    public bool EnableValidationOperations { get; init; }
 
     // Kept only so older service.json files can be loaded and rewritten by the tray.
     [JsonIgnore]