Import the wilm endpoint-monitor and channel-distribution work

Everything on origin/wilm that is not on the published main, applied as one
change because the published history has rewritten hashes: per-commit
cherry-pick conflicts against our main even though the squashed diff applies
clean.

Contents: endpoint monitor catalog + policy attachment + warn-only drift
reconciler, operator issue reports from the tray, agent launch-path allowlist,
and the GHCR channel-image distribution path for dev workstations.

NOT READY FOR main. Open items:
  - 10 new routes are absent from docs/api-inventory.json, so
    test_api_inventory_parity fails. That gate SKIPS on the published mirror
    (the test ships, its data file is scrubbed), which is why wilm never saw it.
  - dev-bootstrap.ps1 and Start-ShopDBDev.ps1 hardcode the ge-aero GitHub org.
  - plugins/endpoints/plugin.py carries a whitespace-only re-indent.

Scope: product

.github/workflows/publish-images.yml

@@ -0,0 +1,81 @@
+# Build and publish per-channel container images to GHCR.
+#
+# WHY this exists: pilot dev workstations sit behind an inspecting proxy
+# (Zscaler) that resets npm's many small fetches mid-install, so building the
+# image FROM SOURCE on a pilot box is unreliable. These runners
+# (arc-runner-set) install npm cleanly - the CI `frontend` job already proves
+# it - so we build the image ONCE here and pilots pull the finished image.
+# A single image pull is one resumable HTTPS stream, far more robust through
+# the proxy than hundreds of npm requests.
+#
+# Channels map to branches:
+#   main   -> ghcr.io/<owner>/shopdb-flask:stable  (badge off)
+#   dev-be -> ghcr.io/<owner>/shopdb-flask:edge    (SHOPDB_ENV_LABEL=DEV badge)
+#
+# Each push to those branches rebuilds and republishes its channel tag, so
+# `edge` stays genuinely bleeding edge. The image is also tagged with the short
+# commit SHA for traceability and rollback.
+
+name: publish-images
+
+on:
+  push:
+    branches:
+      - main
+      - dev-be
+  # Allow a manual rebuild/publish of the current branch's channel image.
+  workflow_dispatch:
+
+# One in-flight publish per branch; a newer push supersedes an older one.
+concurrency:
+  group: publish-images-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-and-push:
+    runs-on: arc-runner-set
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v5
+
+      # Lowercase the owner: GHCR repository paths must be lowercase, but
+      # github.repository_owner can carry uppercase (e.g. ge-aero is fine, but
+      # this keeps the workflow correct for any owner casing).
+      - name: Resolve image name and channel tag
+        id: meta
+        run: |
+          owner="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
+          image="ghcr.io/${owner}/shopdb-flask"
+          if [ "${{ github.ref_name }}" = "main" ]; then
+            channel="stable"
+          else
+            channel="edge"
+          fi
+          echo "image=${image}" >> "$GITHUB_OUTPUT"
+          echo "channel=${channel}" >> "$GITHUB_OUTPUT"
+          echo "sha=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push channel image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.channel }}
+            ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.channel }}-${{ steps.meta.outputs.sha }}
+          # Reuse the channel tag as a cache source/target so subsequent builds
+          # only redo layers that actually changed.
+          cache-from: type=registry,ref=${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.channel }}
+          cache-to: type=inline