Persist Phase 2 system telemetry

Adds rebootreasonsjson, bootinfojson and defenderjson with their migration in the same change, so the model never references a column the schema has not applied.

rebootreasons is not redundant with the existing pendingreboot column. That column is a single bool OR-ed from three registry signals and cannot say which fired, and the difference matters: a staged file rename means the box is mid-servicing, while a lone servicing key can sit set for weeks on a machine nobody rebooted.

Null means never reported and is deliberately distinct from an empty list, which means checked and nothing pending. Backfilling [] would assert every pre-existing endpoint was confirmed clean.

plugins/endpoints/models/endpoint.py

@@ -108,6 +108,27 @@ class EndpointState(db.Model):
     # dying. Null = never reported.
     diskhealthjson = db.Column(db.Text(length=16777215), nullable=True)
 
+    # Which signal(s) drove pendingreboot. That column is a single bool OR-ed
+    # from three sources and so cannot say WHY, and the difference matters: a
+    # pendingfilerename means files are staged for replacement on next boot, so
+    # the box is mid-servicing, while a lone servicing key can sit set for weeks
+    # on a machine nobody rebooted. Empty list = checked, nothing pending.
+    # Null = never reported or the check failed.
+    rebootreasonsjson = db.Column(db.Text(length=16777215), nullable=True)
+
+    # Fast startup configuration and what the last boot actually did. Kept
+    # because uptime is not trustworthy under fast startup: a box can report
+    # days of uptime after what the operator experienced as a shutdown, and a
+    # "reboot" that was a hybrid resume does not clear the state a support call
+    # is usually trying to clear.
+    bootinfojson = db.Column(db.Text(length=16777215), nullable=True)
+
+    # Defender health. Persisted but deliberately NOT surfaced anywhere yet:
+    # this environment produces known false positives, and wiring it to a card
+    # now would train operators to ignore that card. Stored so the history is
+    # already accumulating when someone is ready to interpret it.
+    defenderjson = db.Column(db.Text(length=16777215), nullable=True)
+
     # Warn-only reconciler output, refreshed on every agent check-in in the same
     # commit as servicesjson. Each entry names a policy/shipped-attached monitor
     # the endpoint is expected to be running but the latest snapshot does not