Add the Bamboo site agent

The site agent: a WireGuard peer that dials out to each edge, accepts TCP
streams and native UDP datagrams inside the tunnel, lists local Docker
containers, and runs the local SMTP relay for mail egress. Split out of the
original single repository; depends on Reef for the shared types.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,11 @@
+# Copy to .env (never commit it). Real environment variables win over this file.
+
+# Where Hammerhead is, and this site's token (Sites -> Show command).
+BAMBOO_HAMMERHEAD=https://hammerhead.example.com
+BAMBOO_TOKEN=
+
+# Report local Docker containers so they can be picked as targets.
+#BAMBOO_DOCKER=1
+
+# Folder for this agent's WireGuard key.
+#BAMBOO_DATA=./bamboo-data