Import the wilm endpoint-monitor and channel-distribution work

Everything on origin/wilm that is not on the published main, applied as one
change because the published history has rewritten hashes: per-commit
cherry-pick conflicts against our main even though the squashed diff applies
clean.

Contents: endpoint monitor catalog + policy attachment + warn-only drift
reconciler, operator issue reports from the tray, agent launch-path allowlist,
and the GHCR channel-image distribution path for dev workstations.

NOT READY FOR main. Open items:
  - 10 new routes are absent from docs/api-inventory.json, so
    test_api_inventory_parity fails. That gate SKIPS on the published mirror
    (the test ships, its data file is scrubbed), which is why wilm never saw it.
  - dev-bootstrap.ps1 and Start-ShopDBDev.ps1 hardcode the ge-aero GitHub org.
  - plugins/endpoints/plugin.py carries a whitespace-only re-indent.

Scope: product

tests/test_plugin_migrations.py

@@ -92,9 +92,12 @@ EXPECTED_HEAD_REVISION['warranty'] = 'warranty0002proof'
 # endpoints is a NEW post-cutover plugin: its 0001 genuinely creates the
 # endpointstates + endpointevents tables the core chain never owned, 0002
 # adds the endpointcommands queue plus the MTConnect state columns, 0003
-# adds the generic command target/targetkind columns, and 0004 adds the
-# endpointapplications SBOM snapshot table.
-EXPECTED_HEAD_REVISION['endpoints'] = 'endpoints0005cmdpin'
+# adds the generic command target/targetkind columns, 0004 adds the
+# endpointapplications SBOM snapshot table, 0005 pins a command sha256, 0006
+# seeds the reusable monitor catalog, 0007 ships the shopfloor monitor policy
+# bundle, 0008 adds the warn-only reconciler drift cache column, and 0009 adds
+# the operatorreports table for tray issue reports.
+EXPECTED_HEAD_REVISION['endpoints'] = 'endpoints0009opreports'
 
 # Plugins built after the cutover: their 0001 baseline really creates tables the
 # core chain never owned.