Fix defects found in session review of GE-Enforce plugin

Consolidated fixes from a three-dimension adversarial review.

Data-loss (HIGH): the manifest entry editor stripped fields the form did not
expose, because PUT /entries is a full reset-then-apply. The form now captures
everything - InUseCheck processes as structured name/ExePath/timeout rows (not
just names), LogFile, and the three preinstall flags as checkboxes; the dead
payload-source control (never wired) is removed. New regression test proves an
edit preserves ExePath/timeout/LogFile/PreEnrollment/PCTypesStrict.

Update-entry crash (found by that regression test): replacing an entry's
one-to-one InUseCheck (unique entryid) collided with the old row mid-flush ->
IntegrityError -> 400. update_entry now frees the old InUseCheck (delete+flush)
before populate re-inserts it.

Export truncation (MEDIUM): export_scope_to_share used a plain truncating open,
so a failed/partial write left the live on-share manifest (every PC reads it)
empty. Now writes a temp file in the same dir and os.replace() atomically.

Report dedup case bug (MEDIUM, confirmed by scratch test): the iscurrent demote
matched hostname case-sensitively while the read path uses ilike, so a PC
reporting different casing left two iscurrent rows and double-counted. Demote is
now case-insensitive; regression test added.

Simulator fidelity (MEDIUM): PCTypesStrict was captured but ignored by the
filter mirror, so the simulator wrongly matched a collections-only strict entry
to a nocollections PC via the shared Standard alias group. matches_pctype now
honors PCTypesStrict (disables alias expansion); test added.

Hardening: removed the dead/unscoped GEENFORCE_API_KEY env fallback (never wired
into config; tokens are the only path); create/update entry return 400 on a
duplicate Name instead of 500; parity now asserts scope-level Version/Site; a
new test guards real-manifest field lengths against column limits (the DB-free
parity harness can't see truncation); error handling added to the previously
unguarded editor + reports API calls.

Full suite green; naming + frontend build green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plugins/geenforce/parity.py

@@ -34,10 +34,19 @@ def check_scope(scopename, phase, original, fixtures):
     orig_apps = original.get('Applications') or []
     rebuilt_apps = rebuilt.get('Applications') or []
 
+    # Check 0: scope-level fields (Version, Site) round-trip.
+    firstdiff = None
+    for key in ('Version', 'Site'):
+        if str(original.get(key) or '') != str(rebuilt.get(key) or ''):
+            firstdiff = (f'scope field {key}: '
+                         f'{original.get(key)!r} vs {rebuilt.get(key)!r}')
+            break
+
+    scope_ok = firstdiff is None
+
     # Check 1: field-identical, order-preserving.
     identical = 0
-    firstdiff = None
-    if len(orig_apps) != len(rebuilt_apps):
+    if firstdiff is None and len(orig_apps) != len(rebuilt_apps):
         firstdiff = (f'entry count {len(orig_apps)} vs {len(rebuilt_apps)}')
     for i in range(min(len(orig_apps), len(rebuilt_apps))):
         co = canonical_entry(orig_apps[i])
@@ -59,7 +68,8 @@ def check_scope(scopename, phase, original, fixtures):
         elif firstdiff is None:
             firstdiff = f'filter mismatch for profile {profile.get("label")}'
 
-    passed = (identical == len(orig_apps) == len(rebuilt_apps)
+    passed = (scope_ok
+              and identical == len(orig_apps) == len(rebuilt_apps)
               and profiles_same == len(fixtures))
     return {
         'scopename': scopename,