Import the wilm endpoint-monitor and channel-distribution work

Everything on origin/wilm that is not on the published main, applied as one
change because the published history has rewritten hashes: per-commit
cherry-pick conflicts against our main even though the squashed diff applies
clean.

Contents: endpoint monitor catalog + policy attachment + warn-only drift
reconciler, operator issue reports from the tray, agent launch-path allowlist,
and the GHCR channel-image distribution path for dev workstations.

NOT READY FOR main. Open items:
  - 10 new routes are absent from docs/api-inventory.json, so
    test_api_inventory_parity fails. That gate SKIPS on the published mirror
    (the test ships, its data file is scrubbed), which is why wilm never saw it.
  - dev-bootstrap.ps1 and Start-ShopDBDev.ps1 hardcode the ge-aero GitHub org.
  - plugins/endpoints/plugin.py carries a whitespace-only re-indent.

Scope: product

tests/test_plugins/test_endpoints_plugin.py

@@ -69,11 +69,12 @@ def test_endpoints_asset_panels_are_computer_scoped():
     """Every asset panel targets computer assets only, with an endpoint."""
     plugin = EndpointsPlugin()
     panels = plugin.get_asset_panels()
-    assert len(panels) == 6
+    assert len(panels) == 7
     for panel in panels:
         assert panel['assettypes'] == ['computer']
-        assert panel['endpoint'].startswith('/api/endpoints/asset/{assetid}')
-        assert panel['render'] in ('keyvalue', 'list', 'table')
+        assert panel['endpoint'].startswith('/api/endpoints/')
+        assert '{assetid}' in panel['endpoint']
+        assert panel['render'] in ('keyvalue', 'list', 'table', 'operatorreports')
 
 
 def test_services_and_processes_are_split_into_two_filtered_cards():
@@ -234,7 +235,6 @@ def test_new_hardware_telemetry_keys_are_logged_not_silently_known():
     assert 'applications' in KNOWN_PAYLOAD_KEYS
 
 
-
 def test_telemetrymeta_route_is_registered_for_freshness_gating():
     """The WebUI gates panel refreshes on lastreportedat advancing, so the
     lightweight freshness probe must be exposed on the plugin blueprint."""
@@ -249,3 +249,26 @@ def test_telemetrymeta_route_is_registered_for_freshness_gating():
                                    url_prefix='/api/endpoints')
     rules = {rule.rule for rule in application.url_map.iter_rules()}
     assert any(rule.endswith('/asset/<int:asset_id>/telemetrymeta') for rule in rules)
+
+
+def test_fleet_list_route_resolves_without_trailing_slash():
+    """The Fleet list route must match the slash-less URL the SPA calls.
+
+    The list is the only route on the bare blueprint prefix. If it demands a
+    trailing slash, Flask 308-redirects /api/endpoints to /api/endpoints/, and
+    behind the /shopdb reverse proxy that redirect drops the path prefix and
+    the list call fails while the detail routes (which carry a path suffix)
+    keep working. strict_slashes=False makes both forms resolve directly.
+    """
+    from flask import Flask
+
+    application = Flask(__name__)
+    application.register_blueprint(
+        EndpointsPlugin().get_blueprint(), url_prefix='/api/endpoints')
+    adapter = application.url_map.bind('localhost')
+
+    endpoint, _ = adapter.match('/api/endpoints', method='GET')
+    assert endpoint.endswith('list_endpoints')
+    endpoint_slash, _ = adapter.match('/api/endpoints/', method='GET')
+    assert endpoint_slash.endswith('list_endpoints')
+