Merge the wilm delivery work into main

Ben Baker's installed-software collection, software delivery (run_script and
update_app), agentless adoption tool and command-queue hardening, with his
authorship preserved.

Reviewed before promotion. Fixed: the endpoints plugin tests were never collected
by pytest, the SBOM snapshot table's key would exhaust on MySQL, ingest did not
truncate two columns strict MySQL would reject, and update_app's version branch
pinned a digest for a file that route never serves. Agent packaging moved off
require_role('admin') onto a new endpoints.agentpackage permission.

Contract 0.27.0. Full suite 2231, frontend 314.

agent/.gitignore

@@ -3,5 +3,10 @@ bin/
 obj/
 publish/
 
-# Local publish scratch and command-output captures.
+# Application-delivery development builds. Held in reserve for extensive
+# testing; never shipped to a site publish folder or tracked.
+dev-bin/
+
+# Local publish/staging scratch and command-output captures.
+_stage/
 *.user