Add endpoint software delivery: run_script and update_app push

Adds the two delivery actions to the endpoints command allowlist, each gated on a new endpoints.deploy permission ON TOP OF endpoints.command so pushing software is a heavier grant than a routine toggle. Enqueue validates update_app appversionid ownership and installer presence before queueing. New collector-authenticated download routes let the agent fetch installer packages and script bodies by digest rather than pre-staging them or sending bodies over the command wire. Wires the scriptsApi client, the siteagent generator routes, and a temporary dev-only Delivery test bench (view/route/nav) for exercising the path while the production UI is built.

plugins/endpoints/plugin.py

@@ -147,6 +147,12 @@ class EndpointsPlugin(BasePlugin):
             # remote reboot is a strictly heavier grant than a routine toggle.
             ('endpoints.restart',
              'Restart endpoint computers (destructive)', 'endpoints'),
+            # Elevated grant for software delivery (run_script, update_app).
+            # Required IN ADDITION to endpoints.command by the enqueue route, so
+            # running a staged script or pushing an installer is a strictly
+            # heavier grant than a routine service/process toggle.
+            ('endpoints.deploy',
+             'Run staged scripts and push application installers to endpoints', 'endpoints'),
             # Collector service scope for the endpoint agent. A managed token
             # scoped to ONLY this authorizes the endpoints collector and nothing
             # else, so rotating/revoking it stops endpoint-agent traffic without
@@ -226,6 +232,19 @@ class EndpointsPlugin(BasePlugin):
                 'permission': 'endpoints.fleet',
                 'section': 'assets',
             },
+            # TEMPORARY / DEV ONLY. A manual bench to exercise the update_app and
+            # run_script delivery path while Cameron builds the production UI.
+            # Gated on endpoints.deploy so only delivery operators see it. Remove
+            # this entry (and the DeliveryTestBench view/route) once the real
+            # delivery UI ships.
+            {
+                'name': 'Delivery test bench',
+                'icon': 'send',
+                'route': '/endpoints/delivery-test',
+                'position': 17,
+                'permission': 'endpoints.deploy',
+                'section': 'assets',
+            },
         ]
 
     def init_app(self, app: Flask, db_instance) -> None: