[PRE-91] Use downloadable config profile for Jamf/Fleet

[JoeWagstaff]

Describe your changes:

Jamf: Replace the manual "Configure an agent enrollment profile" steps (hand-built Managed Login Items / Certificate / SCEP / External Applications payloads) with downloading the pre-built profile from the dashboard (Device Management → connection → Settings → Configuration Profile (macOS only)) and uploading it to Jamf; scope it to the agent install policy.
Fleet: Replace the hand-authored smallstep-agent.mobileconfig (Step 4 XML template + base64 CA paste) with the downloaded fleet-.mobileconfig; update the upload step and the GitOps section to reference it.
Fleet: Tighten Step 3 to require naming the CA SMALLSTEP_AGENT (the generated profile hardcodes that suffix); drop the stray $FLEET_VAR_HOST_END_USER_EMAIL_IDP variable (not used by the profile).
Add notes clarifying the profiles rely on Fleet/Jamf substituting their dynamic SCEP values at deploy time, and that the macOS-only profile's SCEP payload still serves iOS/iPadOS.
Keep the API-client/connection/webhook setup steps (the download depends on them).

Related links/other PRs/issues:

Thank you!

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}