Import the wilm endpoint-monitor and channel-distribution work

Everything on origin/wilm that is not on the published main, applied as one
change because the published history has rewritten hashes: per-commit
cherry-pick conflicts against our main even though the squashed diff applies
clean.

Contents: endpoint monitor catalog + policy attachment + warn-only drift
reconciler, operator issue reports from the tray, agent launch-path allowlist,
and the GHCR channel-image distribution path for dev workstations.

NOT READY FOR main. Open items:
  - 10 new routes are absent from docs/api-inventory.json, so
    test_api_inventory_parity fails. That gate SKIPS on the published mirror
    (the test ships, its data file is scrubbed), which is why wilm never saw it.
  - dev-bootstrap.ps1 and Start-ShopDBDev.ps1 hardcode the ge-aero GitHub org.
  - plugins/endpoints/plugin.py carries a whitespace-only re-indent.

Scope: product

tests/test_core/test_authz.py

@@ -94,7 +94,15 @@ EXEMPT_ENDPOINTS = {'knowledgebase.track_click', 'users.update_user',
                     # kill switch. Enqueue (WebUI -> operator) IS permission-gated
                     # on endpoints.command and IS swept. Contract in
                     # plugins/endpoints/AGENT-CONTRACT.md section 7.
-                    'endpoints.report_command_result'}
+                    'endpoints.report_command_result',
+                    # Agent-facing operator issue report upload. Authenticated by
+                    # the endpoints collector API key (same shape as the exempt
+                    # collector blueprint), not JWT+role: the tray hands the
+                    # screenshot and note to the service, which uploads on the
+                    # collector key it already holds. The human-facing read and
+                    # image-serve routes ARE permission-gated on endpoints.view
+                    # and ARE swept.
+                    'endpoints.upload_operator_report'}
 
 
 @pytest.fixture(autouse=True)

tests/test_core/test_public_read_surface.py

@@ -96,6 +96,14 @@ PUBLIC_ENDPOINTS = {
     'endpoints.download_app_package',
     'endpoints.download_app_package_by_app',
     'endpoints.download_script_body',
+
+    # The endpoint agent fetches its server-resolved monitor watch-list (the
+    # processes/services site policy attaches to its PC type) on each telemetry
+    # cycle. Authenticated inside the handler by the endpoints collector API key
+    # - the same shape as claim_next_command - because a bay has no user session.
+    # It is a read of already-scoped policy output, not an authority: attaching a
+    # monitor is gated on the policy editor, audited with the requesting user.
+    'endpoints.resolved_monitors_for_agent',
 }
 
 # Reads that need a LOGIN but no named permission, because the handler decides