Merge the wilm delivery work into main

Ben Baker's installed-software collection, software delivery (run_script and
update_app), agentless adoption tool and command-queue hardening, with his
authorship preserved.

Reviewed before promotion. Fixed: the endpoints plugin tests were never collected
by pytest, the SBOM snapshot table's key would exhaust on MySQL, ingest did not
truncate two columns strict MySQL would reject, and update_app's version branch
pinned a digest for a file that route never serves. Agent packaging moved off
require_role('admin') onto a new endpoints.agentpackage permission.

Contract 0.27.0. Full suite 2231, frontend 314.

agent/ShopDbAdoptionTool/ShopDbAdoptionTool.csproj

@@ -0,0 +1,30 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+	<OutputType>Exe</OutputType>
+	<TargetFramework>net8.0-windows</TargetFramework>
+	<ImplicitUsings>enable</ImplicitUsings>
+	<Nullable>enable</Nullable>
+	<RootNamespace>ShopDbAdoptionTool</RootNamespace>
+	<AssemblyName>shopdb-adopt</AssemblyName>
+	<!-- 0.1.0 (SPIKE): one-shot, agentless enrollment. Uses only the endpoints
+		 collector key to create a ShopDB PC (Computer) + Endpoint entry via the
+		 existing POST /api/collector/endpoints adopt path. Deliberately NOT the
+		 endpoint agent: no service, no polling, no delivery. For sites that want
+		 an inventory entry without running the full agent. -->
+	<Version>0.1.0</Version>
+	<InvariantGlobalization>true</InvariantGlobalization>
+	<RuntimeIdentifier>win-x64</RuntimeIdentifier>
+	<SelfContained>true</SelfContained>
+	<PublishSingleFile>true</PublishSingleFile>
+	<IncludeNativeLibrariesForSelfExtract>true</IncludeNativeLibrariesForSelfExtract>
+	<EnableCompressionInSingleFile>true</EnableCompressionInSingleFile>
+	<DebugType>none</DebugType>
+	<ApplicationManifest>app.manifest</ApplicationManifest>
+  </PropertyGroup>
+
+  <ItemGroup>
+	<PackageReference Include="System.Management" Version="8.0.0" />
+  </ItemGroup>
+
+</Project>