harden CSV import reconciliation and preserve saved model selections

Default fuzzy reconcile threshold to 0 and refuse merges when digit runs differ so numbered labels like Bay 311 never bind to Bay 310. Keep edit forms from clearing saved model fields when category filtering hides untyped rows. Includes in-progress computers policy and endpoints command feature work.

tests/test_core/test_authz.py

@@ -62,7 +62,15 @@ EXEMPT_ENDPOINTS = {'knowledgebase.track_click', 'users.update_user',
                     # GET urls and a preview must not consume a one-view link.
                     # CREATING one is permission-gated and IS swept.
                     # Justification in plugins/tools/README.md.
-                    'tools.redeem_secret'}
+                    'tools.redeem_secret',
+                    # Agent-facing command result callback. Authenticated by the
+                    # endpoints collector API key (same shape as the exempt
+                    # collector blueprint), not JWT+role: the endpoint agent has
+                    # no user account, the collector key is its credential and
+                    # kill switch. Enqueue (WebUI -> operator) IS permission-gated
+                    # on endpoints.command and IS swept. Contract in
+                    # plugins/endpoints/AGENT-CONTRACT.md section 7.
+                    'endpoints.report_command_result'}
 
 
 @pytest.fixture(autouse=True)