Import the wilm endpoint-monitor and channel-distribution work

Everything on origin/wilm that is not on the published main, applied as one
change because the published history has rewritten hashes: per-commit
cherry-pick conflicts against our main even though the squashed diff applies
clean.

Contents: endpoint monitor catalog + policy attachment + warn-only drift
reconciler, operator issue reports from the tray, agent launch-path allowlist,
and the GHCR channel-image distribution path for dev workstations.

NOT READY FOR main. Open items:
  - 10 new routes are absent from docs/api-inventory.json, so
    test_api_inventory_parity fails. That gate SKIPS on the published mirror
    (the test ships, its data file is scrubbed), which is why wilm never saw it.
  - dev-bootstrap.ps1 and Start-ShopDBDev.ps1 hardcode the ge-aero GitHub org.
  - plugins/endpoints/plugin.py carries a whitespace-only re-indent.

Scope: product

Dockerfile

@@ -38,11 +38,40 @@ RUN if [ -f /tmp/corpca/corp-root-ca.pem ]; then \
         cp /tmp/corpca/corp-root-ca.pem /usr/local/share/ca-certificates/corp-root-ca.crt && \
         update-ca-certificates; \
     fi
-ENV NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-root-ca.crt
 
 # Copy only the manifests first so `npm ci` caches on dependency changes.
 COPY frontend/package*.json ./frontend/
-RUN cd frontend && npm ci
+# Trust the corp CA for npm's TLS only when it was actually installed above. The
+# guard keeps NODE_EXTRA_CA_CERTS unset on a clean checkout (no cert), so Node
+# does not warn about a missing cert path; a proxy-inspected build still gets
+# the cert because the file is present.
+# Install the frontend dependencies. vite and the rest of the build toolchain
+# live under devDependencies, so include them explicitly (--include=dev).
+# Behind an inspecting proxy (Zscaler) each package fetch is slow (40-50s) and
+# npm's default concurrency piles up parallel sockets that the proxy resets
+# mid-stream, making npm abort with "Exit handler never called" and leaving an
+# incomplete node_modules with no vite. Serializing to a single socket
+# (maxsockets 1) lets every fetch complete; the retry loop and raised timeouts
+# ride out any remaining transient reset, and the final test hard-verifies the
+# toolchain landed so a truncated install fails loudly here rather than as a
+# confusing "vite: not found" three steps later.
+RUN if [ -f /usr/local/share/ca-certificates/corp-root-ca.crt ]; then \
+        export NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-root-ca.crt; \
+    fi; \
+    cd frontend && \
+    npm config set fetch-retries 5 && \
+    npm config set fetch-retry-factor 2 && \
+    npm config set fetch-retry-mintimeout 20000 && \
+    npm config set fetch-retry-maxtimeout 120000 && \
+    npm config set fetch-timeout 600000 && \
+    npm config set maxsockets 1 && \
+    ( npm ci --include=dev --no-audit --no-fund \
+        || { echo "npm ci attempt 1 failed, retrying..."; sleep 5; npm ci --include=dev --no-audit --no-fund; } \
+        || { echo "npm ci attempt 2 failed, retrying..."; sleep 10; npm ci --include=dev --no-audit --no-fund; } ) && \
+    test -x node_modules/.bin/vite || { \
+        echo "ERROR: node_modules/.bin/vite missing after npm ci (proxy likely truncated the install)."; \
+        exit 1; \
+    }
 
 # The frontend keeps its repo-relative layout here, because npm prebuild runs
 # `node ../scripts/stage-frontend.mjs`, which stages each plugin's frontend/ into
@@ -54,7 +83,10 @@ COPY scripts/stage-frontend.mjs ./scripts/
 COPY plugins/ ./plugins/
 
 COPY frontend/ ./frontend/
-RUN cd frontend && npm run build
+RUN if [ -f /usr/local/share/ca-certificates/corp-root-ca.crt ]; then \
+        export NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-root-ca.crt; \
+    fi; \
+    cd frontend && npm run build
 # Output lands in /build/frontend/dist (Vite default), copied into the final
 # stage below.