Add endpoint monitor catalog and warn-only drift reconciler

Operators need to see when a machine's running services or processes fall outside the desired state defined by policy. This adds a reusable monitor catalog (shipped read-only rows plus user-built local rows), computes drift server-side on agent check-in, and surfaces a warning on the endpoint panels. Remediation stays manual for now; automation can follow once demand is proven. Includes migrations 0006-0008 and the monitors API client.

tests/test_core/test_public_read_surface.py

@@ -96,6 +96,14 @@ PUBLIC_ENDPOINTS = {
     'endpoints.download_app_package',
     'endpoints.download_app_package_by_app',
     'endpoints.download_script_body',
+
+    # The endpoint agent fetches its server-resolved monitor watch-list (the
+    # processes/services site policy attaches to its PC type) on each telemetry
+    # cycle. Authenticated inside the handler by the endpoints collector API key
+    # - the same shape as claim_next_command - because a bay has no user session.
+    # It is a read of already-scoped policy output, not an authority: attaching a
+    # monitor is gated on the policy editor, audited with the requesting user.
+    'endpoints.resolved_monitors_for_agent',
 }
 
 # Reads that need a LOGIN but no named permission, because the handler decides