Import the wilm endpoint-monitor and channel-distribution work

Everything on origin/wilm that is not on the published main, applied as one
change because the published history has rewritten hashes: per-commit
cherry-pick conflicts against our main even though the squashed diff applies
clean.

Contents: endpoint monitor catalog + policy attachment + warn-only drift
reconciler, operator issue reports from the tray, agent launch-path allowlist,
and the GHCR channel-image distribution path for dev workstations.

NOT READY FOR main. Open items:
  - 10 new routes are absent from docs/api-inventory.json, so
    test_api_inventory_parity fails. That gate SKIPS on the published mirror
    (the test ships, its data file is scrubbed), which is why wilm never saw it.
  - dev-bootstrap.ps1 and Start-ShopDBDev.ps1 hardcode the ge-aero GitHub org.
  - plugins/endpoints/plugin.py carries a whitespace-only re-indent.

Scope: product

scripts/uninstall-shopdbagent.ps1

@@ -114,6 +114,15 @@ Start-Sleep -Seconds 1
 Write-Host "[3/6] Removing registry entries ..."
 Remove-HklmBothViews -SubKey "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "ShopDbEndpointTray"
 Remove-HklmBothViews -SubKey "SOFTWARE\GE\ShopDB"
+
+# Remove the All-Users Start Menu shortcut the site-agent installer created.
+$commonPrograms = [Environment]::GetFolderPath([Environment+SpecialFolder]::CommonPrograms)
+$shortcutPath = Join-Path $commonPrograms "ShopDB Agent.lnk"
+if (Test-Path $shortcutPath) {
+	try { Remove-Item -Path $shortcutPath -Force -ErrorAction Stop; Write-Host "  removed Start Menu shortcut $shortcutPath" }
+	catch { Write-Warning "  could not remove Start Menu shortcut: $($_.Exception.Message)" }
+}
+
 # Drop the parent GE key only if we emptied it (some sites nest siblings under
 # GE such as SFLD; never tree-delete a key we do not own).
 foreach ($view in @([Microsoft.Win32.RegistryView]::Registry64,