Import the wilm endpoint-monitor and channel-distribution work

Everything on origin/wilm that is not on the published main, applied as one
change because the published history has rewritten hashes: per-commit
cherry-pick conflicts against our main even though the squashed diff applies
clean.

Contents: endpoint monitor catalog + policy attachment + warn-only drift
reconciler, operator issue reports from the tray, agent launch-path allowlist,
and the GHCR channel-image distribution path for dev workstations.

NOT READY FOR main. Open items:
  - 10 new routes are absent from docs/api-inventory.json, so
    test_api_inventory_parity fails. That gate SKIPS on the published mirror
    (the test ships, its data file is scrubbed), which is why wilm never saw it.
  - dev-bootstrap.ps1 and Start-ShopDBDev.ps1 hardcode the ge-aero GitHub org.
  - plugins/endpoints/plugin.py carries a whitespace-only re-indent.

Scope: product

plugins/computers/models/__init__.py

@@ -13,6 +13,7 @@ from .policy import (
     BusinessPolicy,
     BusinessPolicyItem,
     POLICY_SOURCE_LOCAL,
+    POLICY_SOURCE_SHIPPED,
     ACTION_MODE_DESIRED,
     ACTION_MODE_GATE,
 )
@@ -28,6 +29,7 @@ __all__ = [
     'BusinessPolicy',
     'BusinessPolicyItem',
     'POLICY_SOURCE_LOCAL',
+    'POLICY_SOURCE_SHIPPED',
     'ACTION_MODE_DESIRED',
     'ACTION_MODE_GATE',
 ]

plugins/computers/models/policy.py

@@ -27,6 +27,12 @@ from .jsontext import JSONText
 # owner. Kept a plain string, not an enum column, so adding a source is data.
 POLICY_SOURCE_LOCAL = 'local'
 
+# Product-owned rows we ship (the shopfloor app monitor bundle). Same read-only
+# treatment as any non-local source: the CRUD API refuses to edit or delete
+# them, the seeder reconciles them. Distinct from 'local' so a site's own
+# policies are never confused with what the product shipped.
+POLICY_SOURCE_SHIPPED = 'shipped'
+
 
 class ConfigurationPolicy(BaseModel):
     """A single reusable policy: a scope plus the actions it applies.