Add endpoint software delivery: run_script and update_app push

Adds the two delivery actions to the endpoints command allowlist, each gated on a new endpoints.deploy permission ON TOP OF endpoints.command so pushing software is a heavier grant than a routine toggle. Enqueue validates update_app appversionid ownership and installer presence before queueing. New collector-authenticated download routes let the agent fetch installer packages and script bodies by digest rather than pre-staging them or sending bodies over the command wire. Wires the scriptsApi client, the siteagent generator routes, and a temporary dev-only Delivery test bench (view/route/nav) for exercising the path while the production UI is built.

plugins/endpoints/commands.py

@@ -77,6 +77,22 @@ COMMAND_ALLOWLIST = {
         'label': 'Collect now',
         'description': 'Force the endpoint agent to report fresh telemetry off-cadence.',
     },
+    'run_script': {
+        'label': 'Run script',
+        'description': 'Run a ShopDB-hosted script on the endpoint. The agent '
+                       'fetches the script body by digest using its collector '
+                       'credential and runs it in the script\'s configured '
+                       'context (system or the logged-on user).',
+        'targetkind': 'script',
+    },
+    'update_app': {
+        'label': 'Install/update application',
+        'description': 'Push a ShopDB-hosted installer for an application (by app '
+                       'or by a specific version). The agent fetches the pinned '
+                       'package by digest using its collector credential and runs '
+                       'it silently.',
+        'targetkind': 'app',
+    },
 }
 
 
@@ -85,6 +101,8 @@ COMMAND_ALLOWLIST = {
 # destructive action (a remote reboot) is a heavier grant than a routine toggle.
 ELEVATED_ACTION_PERMISSIONS = {
     'system_restart': 'endpoints.restart',
+    'run_script': 'endpoints.deploy',
+    'update_app': 'endpoints.deploy',
 }