Import the wilm endpoint-monitor and channel-distribution work

Everything on origin/wilm that is not on the published main, applied as one
change because the published history has rewritten hashes: per-commit
cherry-pick conflicts against our main even though the squashed diff applies
clean.

Contents: endpoint monitor catalog + policy attachment + warn-only drift
reconciler, operator issue reports from the tray, agent launch-path allowlist,
and the GHCR channel-image distribution path for dev workstations.

NOT READY FOR main. Open items:
  - 10 new routes are absent from docs/api-inventory.json, so
    test_api_inventory_parity fails. That gate SKIPS on the published mirror
    (the test ships, its data file is scrubbed), which is why wilm never saw it.
  - dev-bootstrap.ps1 and Start-ShopDBDev.ps1 hardcode the ge-aero GitHub org.
  - plugins/endpoints/plugin.py carries a whitespace-only re-indent.

Scope: product

docs/DEV-BUILD-TEST.md

@@ -0,0 +1,45 @@
+# ShopDB dev build - quick test
+
+Two dev builds you can stand up on a Windows box with Docker Desktop. You run
+one PowerShell script: it checks your dependencies (offers to winget-install
+anything missing), then PULLS a prebuilt image from GHCR and starts the stack in
+Docker. Nothing is compiled on your machine - no Node, no npm, no source build -
+so it works on a box that has only Docker installed.
+
+## What you need
+
+- Windows with Docker Desktop running.
+- Git for Windows (`winget install Git.Git`).
+- A GitHub login for this private repo/registry already stored on the box. If
+  you have cloned this repo before, or signed in to GitHub in Visual Studio or
+  VS Code, you already have it - the script uses that stored credential
+  automatically. If Docker cannot pull the image, sign in once with
+  `docker login ghcr.io` (use a GitHub username and a personal access token that
+  has `read:packages`), then re-run the launcher.
+
+## Get the launcher
+
+You will be sent `Start-ShopDBDev.ps1` directly. Save it anywhere (for example
+your Downloads folder) and open PowerShell in that folder.
+
+## Bleeding edge (dev-be)
+
+	powershell -ExecutionPolicy Bypass -File .\Start-ShopDBDev.ps1 -Channel edge
+
+Comes up at https://localhost:5011. Red DEV badge in the sidebar. Pulls the
+`edge` image.
+
+## Stable (main)
+
+	powershell -ExecutionPolicy Bypass -File .\Start-ShopDBDev.ps1 -Channel stable
+
+Comes up at https://localhost:5001. No DEV badge. Pulls the `stable` image.
+
+## Notes
+
+- Both stacks can run at the same time - they use different ports and separate
+  Docker volumes, so they do not collide and each keeps its own database.
+- Each launch pulls the latest image for the channel, so re-running the launcher
+  is how you pick up a new build. No local rebuild step.
+- First page load shows a self-signed cert warning (expected for a dev box).
+- Stop a stack:  `docker compose -p shopdb-stable down`  (or `shopdb-edge`).