Cache endpoint health as a ranked rollup

Fleet ranked endpoints by raw critical-event counts, so a machine with a
noisy but harmless event log outranked one with a mapped drive down or a
blocking service stopped. Volume is not severity, and the aggregation ran
across the whole fleet on every page load.

Rank operational blockers above degraded conditions above event noise, and
cache the verdict per asset so Fleet reads a row instead of recomputing 48h
of history. Transitions are written only when a verdict changes, capped at
50 rows per asset.

Absence of a policy binding must never suppress a verdict: drives and events
are not policy-gated, and services fall back to a built-in default impact
when no mapping applies. Event 1001 drops to informational because the WER
bucket pairs with 1000 and double-counted every crash.

Parallelize the Fleet first-paint loaders that were awaiting serially.

plugins/endpoints/plugin.py

@@ -1274,6 +1274,27 @@ class EndpointsPlugin(BasePlugin):
         # flush, not commit: the collector dispatcher owns the transaction.
         db.session.flush()
 
+        # Health rollup, AFTER the flush so the events just written are visible
+        # to the evaluator's query in this same transaction. Recomputed here,
+        # per asset, rather than by the Fleet page across the whole fleet on
+        # every load - the verdict changes when telemetry changes, so this is
+        # where it belongs, and it lands in the SAME commit as the telemetry it
+        # was derived from.
+        #
+        # Fail-open, matching the reconciler above: a health error must never
+        # fail an otherwise-good check-in. The previous verdict simply stands,
+        # which is correct - a failed evaluation is not evidence of health.
+        try:
+            from .services.health import evaluate_endpoint_health
+            evaluate_endpoint_health(
+                assetid, state,
+                computertypeid=getattr(computer, 'computertypeid', None))
+            db.session.flush()
+        except Exception:
+            logger.exception(
+                'health evaluation failed for asset %s; leaving verdict '
+                'unchanged', assetid)
+
         return {
             'action': action,
             'assetid': assetid,