stage and retain versioned agent binaries

Add per-version staging, retention (keep 3), and upload/rollback routes for shopdbagent.exe and the tray exe. Keep upload under endpoints.agentpackage and declare a distinct endpoints.agentupdate permission for the future live-push pipe so app-deploy rights never imply SYSTEM agent replacement.

plugins/endpoints/plugin.py

@@ -179,6 +179,19 @@ class EndpointsPlugin(BasePlugin):
              ('endpoints.agentpackage',
               'Generate and download an agent or adoption-tool package '
               '(contains a live collector key)', 'endpoints'),
+             # Pushing an agent REPLACEMENT to running endpoints is a distinct,
+             # heavier job than either packaging (endpoints.agentpackage) or
+             # pushing an ordinary application installer (endpoints.deploy).
+             # Kept separate on purpose: the agent runs as SYSTEM and is the
+             # command channel itself, so replacing it is self-modifying the
+             # control plane. Folding it into endpoints.deploy would let anyone
+             # who can push an app silently swap the agent; folding it into
+             # endpoints.agentpackage would let a packager who only mints ZIPs
+             # also force a live fleet-wide swap. A future Operator role can
+             # hold upload without this, or this without upload.
+             ('endpoints.agentupdate',
+              'Push agent/tray binary updates to running endpoints '
+              '(replaces the SYSTEM agent)', 'endpoints'),
              # Collector service scope for the endpoint agent. A managed token
             # scoped to ONLY this authorizes the endpoints collector and nothing
             # else, so rotating/revoking it stops endpoint-agent traffic without