Import the wilm endpoint-monitor and channel-distribution work

Everything on origin/wilm that is not on the published main, applied as one
change because the published history has rewritten hashes: per-commit
cherry-pick conflicts against our main even though the squashed diff applies
clean.

Contents: endpoint monitor catalog + policy attachment + warn-only drift
reconciler, operator issue reports from the tray, agent launch-path allowlist,
and the GHCR channel-image distribution path for dev workstations.

NOT READY FOR main. Open items:
  - 10 new routes are absent from docs/api-inventory.json, so
    test_api_inventory_parity fails. That gate SKIPS on the published mirror
    (the test ships, its data file is scrubbed), which is why wilm never saw it.
  - dev-bootstrap.ps1 and Start-ShopDBDev.ps1 hardcode the ge-aero GitHub org.
  - plugins/endpoints/plugin.py carries a whitespace-only re-indent.

Scope: product

plugins/computers/plugin.py

@@ -559,9 +559,9 @@ class ComputersPlugin(BasePlugin):
             },
             {
                 'group': 'Computers',
-                'to': '/settings/business-policies',
+                'to': '/settings/site-policies',
                 'icon': 'layers',
-                'title': 'Business policies',
+                'title': 'Site policies',
                 'description': 'Ordered collections of configuration policies '
                                'assigned by priority',
                 'position': 28,
@@ -633,7 +633,7 @@ class ComputersPlugin(BasePlugin):
                 'valuetype': 'boolean',
                 'category': 'computers',
                 'description': 'Master switch for RMM-style Configuration and '
-                               'Business Policies. Off by default: models exist '
+                               'Site Policies. Off by default: models exist '
                                'but the CRUD routes, WebUI, and endpoint '
                                'enforcement stay inert so the whole feature can '
                                'be rolled back without a schema change.',