Add installer/script delivery metadata to the core software model

AppVersion gains sha256 and silentargs so the endpoint update_app push can pin exact installer bytes and carry per-version silent switches; Application gains installersha256 for the app-level install source. New ShopDB-hosted script library (Script model plus scripts API) backs run_script delivery, with the body fetched by digest on push rather than pre-staged or sent over the command wire. Two idempotent migrations with real downgrades. Script added to the shopdb.api contract surface for plugin use.

migrations/versions/7d35_appversion_delivery_metadata.py

@@ -0,0 +1,46 @@
+"""Add appversions.sha256 and appversions.silentargs (installer delivery metadata)
+
+The endpoint installer push resolves a specific AppVersion: sha256 pins the
+exact bytes the agent must fetch, and silentargs carries this version's
+unattended-install switches (homegrown EXEs vary by developer; MSI is uniform
+via msiexec). Both nullable. Idempotent guards and real downgrade.
+
+Revision ID: 7d35_appversion_delivery_metadata
+Revises: 7d34_singular_relationship_types
+Create Date: 2026-07-24
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = '7d35_appversion_delivery_metadata'
+down_revision = '7d34_singular_relationship_types'
+branch_labels = None
+depends_on = None
+
+
+def _has_col(insp, name):
+    return any(c['name'] == name for c in insp.get_columns('appversions'))
+
+
+def upgrade():
+    bind = op.get_bind()
+    insp = sa.inspect(bind)
+    if 'appversions' not in insp.get_table_names():
+        return
+    if not _has_col(insp, 'sha256'):
+        op.add_column('appversions', sa.Column('sha256', sa.String(length=64), nullable=True))
+    if not _has_col(insp, 'silentargs'):
+        op.add_column('appversions', sa.Column('silentargs', sa.String(length=255), nullable=True))
+
+
+def downgrade():
+    bind = op.get_bind()
+    insp = sa.inspect(bind)
+    if 'appversions' not in insp.get_table_names():
+        return
+    if _has_col(insp, 'silentargs'):
+        op.drop_column('appversions', 'silentargs')
+    if _has_col(insp, 'sha256'):
+        op.drop_column('appversions', 'sha256')