Merge the wilm delivery work into main

Ben Baker's installed-software collection, software delivery (run_script and
update_app), agentless adoption tool and command-queue hardening, with his
authorship preserved.

Reviewed before promotion. Fixed: the endpoints plugin tests were never collected
by pytest, the SBOM snapshot table's key would exhaust on MySQL, ingest did not
truncate two columns strict MySQL would reject, and update_app's version branch
pinned a digest for a file that route never serves. Agent packaging moved off
require_role('admin') onto a new endpoints.agentpackage permission.

Contract 0.27.0. Full suite 2231, frontend 314.

.gitignore

@@ -73,6 +73,10 @@ id_rsa.*
 *.ppk
 *.p12
 *.pfx
+
+# Local/test TLS material for the dev HTTPS listener. Self-signed, per-host,
+# never shipped. The container mounts these at runtime; a site provides its own.
+certs/
 secrets.json
 secrets.yaml
 secrets.yml
@@ -92,3 +96,46 @@ devnotes/
 # defeats the intentional skip in the docs publish/version tests. Keep this
 # local-only guide out of version control so those tests skip as designed.
 docs/CSV-IMPORT-GUIDE.md
+
+# Local-only authored docs (executive summaries, workflow/security writeups,
+# planner exports, draft decks and diagrams). Same reasoning as above: keep
+# personal docs out of version control. docs/openapi.json stays tracked and
+# is intentionally NOT ignored here.
+docs/EXECUTIVE-SUMMARY.md
+docs/DESIGN-DECISIONS-agent.md
+docs/OPERATOR-WORKFLOW.md
+docs/SECURITY-RISK-ASSESSMENT.md
+docs/ShopDB-Planner-Tasks.csv
+docs/DRAFT--ShopDB-CSV-Import-Guide.pptx
+docs/diagrams/
+docs/media/
+
+# Local-only working artifacts: DB dumps, sample/test datasets, scratch
+# scripts, captured command output, generated maps/reports, vulnerability
+# scan output, and staged agent publish trees. None of these are product
+# source; they are developer scratch that should never enter version control.
+# exports/ (merge kits, decks, catalog snapshots) stays on disk for reference
+# but is not tracked.
+backups/
+exports/
+testdata/
+vuln/
+agent/publish-wjf/
+*.sql
+shopmap.pdf
+shopmap.png
+agent_build.txt
+agent_publish.txt
+backend_out.txt
+backend_out2.txt
+docker_build.txt
+docker_up.txt
+gates_out.txt
+pytest_targeted.txt
+alandry.py
+kendry.py
+
+# Scratch tooling under scripts/ (catalog diff/merge helpers, docx generator).
+# Not product source; developer-local utilities.
+scripts/.temp/
+scripts/docs/