Promote the 2026-08-30 review security fixes and supplies ordering to main

agent/ShopDbEndpointAgent.Core/CommandClient.cs

@@ -64,10 +64,17 @@ public sealed class CommandClient : IDisposable
     // result is logged and swallowed so a transient network blip does not crash
     // the worker; the command simply stays 'running' server-side until a later
     // operator retry supersedes it.
+    // hostname rides along so the server can check this agent owns the command
+    // it is finalizing. The shared collector key does not say who is calling,
+    // so without it any agent can post a result for any command id. The server
+    // treats the parameter as optional for older agents and enforces it when
+    // present, so shipping this ahead of a fleet update is safe.
     public async Task ReportResultAsync(
-        int commandId, CommandResult result, CancellationToken token)
+        int commandId, string hostname, CommandResult result,
+        CancellationToken token)
     {
-        var url = $"api/endpoints/commands/{commandId}/result";
+        var url = $"api/endpoints/commands/{commandId}/result?hostname="
+            + Uri.EscapeDataString(hostname);
         using var response = await http.PostAsJsonAsync(
             url, result, JsonOptions, token);
         if (!response.IsSuccessStatusCode)

agent/ShopDbEndpointAgent.Core/CommandWorker.cs

@@ -130,7 +130,8 @@ public sealed class CommandWorker : BackgroundService
             };
         }
 
-        await client.ReportResultAsync(claim.EndpointCommandId, result, token);
+        await client.ReportResultAsync(
+            claim.EndpointCommandId, hostname, result, token);
         logger.LogInformation("Command {Id} finished succeeded={Succeeded}",
             claim.EndpointCommandId, result.Succeeded);