Add multi-action policy holds and exempt collect_now from policy

Adds PolicyActionHold so an admin can suspend specific actions on a computer without editing the policy itself, covering the break-glass case where a machine must be quiesced immediately. Holds cover multiple actions in one atomic submission rather than one row per action, so a partial failure cannot leave a half-applied hold. Duration is free-form with 0 meaning indefinite (migration 0006 makes expiresat nullable); the prior fixed ceiling was removed because an admin quiescing a misbehaving machine does not know in advance how long it needs, and a hold silently expiring is worse than one that must be cleared deliberately. The What This Does explainer reflects indefinite holds.

collect_now exemption: refreshing status was denied on any endpoint with a non-empty effective policy even when the caller held the matching grant, because policy intersection silently removed the action. collect_now is a read-only status refresh with no side effects, so it now sits in POLICY_EXEMPT_ACTIONS alongside the other routine actions. Verified against a synthetic non-empty policy: operators can refresh status again while every write action stays gated.

plugins/computers/models/__init__.py

@@ -16,6 +16,8 @@ from .policy import (
     POLICY_SOURCE_SHIPPED,
     ACTION_MODE_DESIRED,
     ACTION_MODE_GATE,
+    PolicyActionHold,
+    DEFAULT_HOLD_MINUTES,
 )
 
 __all__ = [
@@ -32,4 +34,6 @@ __all__ = [
     'POLICY_SOURCE_SHIPPED',
     'ACTION_MODE_DESIRED',
     'ACTION_MODE_GATE',
+    'PolicyActionHold',
+    'DEFAULT_HOLD_MINUTES',
 ]