Import the wilm endpoint-monitor and channel-distribution work

Everything on origin/wilm that is not on the published main, applied as one
change because the published history has rewritten hashes: per-commit
cherry-pick conflicts against our main even though the squashed diff applies
clean.

Contents: endpoint monitor catalog + policy attachment + warn-only drift
reconciler, operator issue reports from the tray, agent launch-path allowlist,
and the GHCR channel-image distribution path for dev workstations.

NOT READY FOR main. Open items:
  - 10 new routes are absent from docs/api-inventory.json, so
    test_api_inventory_parity fails. That gate SKIPS on the published mirror
    (the test ships, its data file is scrubbed), which is why wilm never saw it.
  - dev-bootstrap.ps1 and Start-ShopDBDev.ps1 hardcode the ge-aero GitHub org.
  - plugins/endpoints/plugin.py carries a whitespace-only re-indent.

Scope: product

plugins/computers/services/policyresolver.py

@@ -166,3 +166,61 @@ def effective_policy_for(assetid):
 
     business_policies = BusinessPolicy.query.filter_by(isactive=True).all()
     return build_effective_policy(computer, business_policies)
+
+
+def _monitor_action_ids(effective):
+    """Extract attached monitor ids from an EffectivePolicy's action names.
+
+    Monitor attachment rides the policy layer as an action named
+    'monitor:<endpointmonitorid>' (see plugins/endpoints/commands.py). This
+    reads those ids back out of a resolved policy so a caller can turn them into
+    concrete monitor definitions.
+    """
+    ids = set()
+    for name in effective.allowed_actions():
+        if isinstance(name, str) and name.startswith('monitor:'):
+            raw = name[len('monitor:'):]
+            try:
+                ids.add(int(raw))
+            except (TypeError, ValueError):
+                continue
+    return ids
+
+
+def monitor_ids_for_asset(assetid):
+    """Set of endpointmonitorids attached to an endpoint by effective policy."""
+    return _monitor_action_ids(effective_policy_for(assetid))
+
+
+def monitor_ids_for_pctype(computertypeid):
+    """Set of endpointmonitorids attached to a PC type by effective policy.
+
+    Folds active Business Policies against a synthetic context carrying only the
+    PC type (no installed apps), which is what the agent runtime-fetch path needs
+    when it resolves its monitor set by type rather than by a specific asset.
+    Returns an empty set when the policy feature is off.
+    """
+    from ..policyflag import policy_flag_enabled
+    if not policy_flag_enabled():
+        return set()
+
+    from ..models import BusinessPolicy
+
+    context = {'computertypeid': computertypeid, 'appids': set()}
+    business_policies = BusinessPolicy.query.filter_by(isactive=True).all()
+    resolved = {}
+    for businesspolicyid, config_policy in _iter_matching_configpolicies(
+            business_policies, context):
+        for action_row in config_policy.actions:
+            if not action_row.isactive:
+                continue
+            resolved.setdefault(action_row.action, True)
+    ids = set()
+    for name in resolved:
+        if isinstance(name, str) and name.startswith('monitor:'):
+            raw = name[len('monitor:'):]
+            try:
+                ids.add(int(raw))
+            except (TypeError, ValueError):
+                continue
+    return ids