Import the wilm endpoint-monitor and channel-distribution work

Everything on origin/wilm that is not on the published main, applied as one
change because the published history has rewritten hashes: per-commit
cherry-pick conflicts against our main even though the squashed diff applies
clean.

Contents: endpoint monitor catalog + policy attachment + warn-only drift
reconciler, operator issue reports from the tray, agent launch-path allowlist,
and the GHCR channel-image distribution path for dev workstations.

NOT READY FOR main. Open items:
  - 10 new routes are absent from docs/api-inventory.json, so
    test_api_inventory_parity fails. That gate SKIPS on the published mirror
    (the test ships, its data file is scrubbed), which is why wilm never saw it.
  - dev-bootstrap.ps1 and Start-ShopDBDev.ps1 hardcode the ge-aero GitHub org.
  - plugins/endpoints/plugin.py carries a whitespace-only re-indent.

Scope: product

docker-compose.airgap.yml

@@ -32,6 +32,10 @@ x-app-env: &app-env
   LOG_LEVEL: ${LOG_LEVEL:-INFO}
   ZABBIX_URL: ${ZABBIX_URL:-}
   ZABBIX_TOKEN: ${ZABBIX_TOKEN:-}
+  # Channel label for a distributable installer. Empty on the stable (main)
+  # bundle, 'DEV' on the edge (dev-be) bundle, which lights up the sidebar
+  # badge. Sourced from .env, which build-channel-installer.ps1 pre-fills.
+  SHOPDB_ENV_LABEL: ${SHOPDB_ENV_LABEL:-}
 
 services:
   db: