Import the wilm endpoint-monitor and channel-distribution work

Everything on origin/wilm that is not on the published main, applied as one
change because the published history has rewritten hashes: per-commit
cherry-pick conflicts against our main even though the squashed diff applies
clean.

Contents: endpoint monitor catalog + policy attachment + warn-only drift
reconciler, operator issue reports from the tray, agent launch-path allowlist,
and the GHCR channel-image distribution path for dev workstations.

NOT READY FOR main. Open items:
  - 10 new routes are absent from docs/api-inventory.json, so
    test_api_inventory_parity fails. That gate SKIPS on the published mirror
    (the test ships, its data file is scrubbed), which is why wilm never saw it.
  - dev-bootstrap.ps1 and Start-ShopDBDev.ps1 hardcode the ge-aero GitHub org.
  - plugins/endpoints/plugin.py carries a whitespace-only re-indent.

Scope: product

plugins/endpoints/frontend/routes.js

@@ -18,6 +18,12 @@ export default [
     component: () => import('./views/AgentKeySettings.vue'),
     meta: { requiresAuth: true, requiresAdmin: true, plugin: 'endpoints' }
   },
+  {
+    path: 'settings/endpoints/monitors',
+    name: 'endpoints-monitors-settings',
+    component: () => import('./views/MonitorsSettings.vue'),
+    meta: { requiresAuth: true, requiresAdmin: true, plugin: 'endpoints' }
+  },
   // TEMPORARY / DEV ONLY. A manual bench to exercise the update_app and
   // run_script delivery path end to end while Cameron builds the real UI.
   // Gated on endpoints.deploy inside the view; remove once the production