Import the wilm endpoint-monitor and channel-distribution work

Everything on origin/wilm that is not on the published main, applied as one
change because the published history has rewritten hashes: per-commit
cherry-pick conflicts against our main even though the squashed diff applies
clean.

Contents: endpoint monitor catalog + policy attachment + warn-only drift
reconciler, operator issue reports from the tray, agent launch-path allowlist,
and the GHCR channel-image distribution path for dev workstations.

NOT READY FOR main. Open items:
  - 10 new routes are absent from docs/api-inventory.json, so
    test_api_inventory_parity fails. That gate SKIPS on the published mirror
    (the test ships, its data file is scrubbed), which is why wilm never saw it.
  - dev-bootstrap.ps1 and Start-ShopDBDev.ps1 hardcode the ge-aero GitHub org.
  - plugins/endpoints/plugin.py carries a whitespace-only re-indent.

Scope: product

frontend/src/views/AppLayout.vue

@@ -4,6 +4,9 @@
       <div class="sidebar-header">
         <img :src="siteLogo" alt="Site logo" class="sidebar-logo" />
         <h1>{{ facilityName }}</h1>
+        <!-- Only present when the container sets SHOPDB_ENV_LABEL (edge/dev
+             channel). Stable leaves it empty, so nothing renders. --><span
+          v-if="envLabel" class="env-badge">{{ envLabel }}</span>
         <!-- Under the site name, where the classic site put it. -->
         <div class="fiscal-week">
           <span class="fiscal-week-label">Fiscal Week</span>
@@ -122,7 +125,7 @@ import { useAuthStore } from '../stores/auth'
 import { currentTheme, toggleTheme } from '../stores/theme'
 import { dashboardApi, notificationsApi } from '../api'
 import { fiscalWeek } from '@/utils/fiscalWeek'
-import { getFacilityName, getSiteLogo, getServicenowUrls } from '../utils/siteSettings'
+import { getFacilityName, getSiteLogo, getServicenowUrls, getEnvLabel } from '../utils/siteSettings'
 import { withBase } from '../utils/basePath'
 
 const router = useRouter()
@@ -155,6 +158,7 @@ const cansearch = ref(false)
 const navItems = ref([])
 const activeNotifications = ref([])
 const facilityName = ref('ShopDB')
+const envLabel = ref('')
 
 // A tab left open overnight would otherwise show last week's number until
 // somebody reloaded. Recomputed on a timer rather than only at mount.
@@ -286,6 +290,7 @@ onMounted(async () => {
   fiscalWeekTimer = setInterval(() => { currentFiscalWeek.value = fiscalWeek() }, 30 * 60 * 1000)
 
   getFacilityName().then(name => { facilityName.value = name })
+  getEnvLabel().then(label => { envLabel.value = label })
   getSiteLogo().then(logo => { siteLogo.value = logo })
   getServicenowUrls().then(config => { servicenowConfig.value = config })
 
@@ -352,6 +357,21 @@ onUnmounted(() => {
 </script>
 
 <style scoped>
+/* Bleeding-edge channel badge. Loud red on purpose so a dev container is never
+   mistaken for stable when the two run side by side. Only rendered when the
+   backend reports a non-empty env_label (SHOPDB_ENV_LABEL). */
+.env-badge {
+  display: inline-block;
+  margin-top: 0.35rem;
+  padding: 0.1rem 0.5rem;
+  border-radius: 3px;
+  background: #c62828;
+  color: #fff;
+  font-size: 0.62rem;
+  font-weight: 700;
+  letter-spacing: 0.12em;
+  text-transform: uppercase;
+}
 /* Fiscal week, under the site name, where the classic site put it. The number
    carries the weight; the label is small because it never changes. */
 .fiscal-week {