Import the wilm endpoint-monitor and channel-distribution work

Everything on origin/wilm that is not on the published main, applied as one
change because the published history has rewritten hashes: per-commit
cherry-pick conflicts against our main even though the squashed diff applies
clean.

Contents: endpoint monitor catalog + policy attachment + warn-only drift
reconciler, operator issue reports from the tray, agent launch-path allowlist,
and the GHCR channel-image distribution path for dev workstations.

NOT READY FOR main. Open items:
  - 10 new routes are absent from docs/api-inventory.json, so
    test_api_inventory_parity fails. That gate SKIPS on the published mirror
    (the test ships, its data file is scrubbed), which is why wilm never saw it.
  - dev-bootstrap.ps1 and Start-ShopDBDev.ps1 hardcode the ge-aero GitHub org.
  - plugins/endpoints/plugin.py carries a whitespace-only re-indent.

Scope: product

frontend/src/api/index.js

@@ -178,6 +178,25 @@ export const endpointsApi = {
   },
   telemetryMeta(assetId) {
     return api.get(`/endpoints/asset/${assetId}/telemetrymeta`)
+  },
+  // Monitor catalog: reusable process/service definitions. Shipped rows are
+  // product-owned and read-only; local rows are user-built on the Settings page.
+  monitors: {
+    list() {
+      return api.get('/endpoints/monitors')
+    },
+    create(data) {
+      return api.post('/endpoints/monitors', data)
+    },
+    update(monitorid, data) {
+      return api.put(`/endpoints/monitors/${monitorid}`, data)
+    },
+    remove(monitorid) {
+      return api.delete(`/endpoints/monitors/${monitorid}`)
+    },
+    resolve(pctype) {
+      return api.get('/endpoints/monitors/resolve', { params: { pctype } })
+    }
   }
 }