Merge the wilm delivery work into main

Ben Baker's installed-software collection, software delivery (run_script and
update_app), agentless adoption tool and command-queue hardening, with his
authorship preserved.

Reviewed before promotion. Fixed: the endpoints plugin tests were never collected
by pytest, the SBOM snapshot table's key would exhaust on MySQL, ingest did not
truncate two columns strict MySQL would reject, and update_app's version branch
pinned a digest for a file that route never serves. Agent packaging moved off
require_role('admin') onto a new endpoints.agentpackage permission.

Contract 0.27.0. Full suite 2231, frontend 314.

docker-compose.yml

@@ -65,8 +65,43 @@ services:
       COLLECTOR_API_KEY_ENDPOINTS: ${COLLECTOR_API_KEY_ENDPOINTS:-}
     ports:
       - "${API_PORT:-5001}:5001"
+    # Terminate TLS in gunicorn with the mounted self-signed cert so the browser
+    # sees a secure context. navigator.clipboard and other secure-context-only
+    # web APIs refuse to run over plain http on a non-localhost origin, so the
+    # test box (accessed by FQDN) needs real https. A site swaps in its own cert
+    # under ./certs or fronts this with its IIS/nginx proxy.
+    command:
+      - gunicorn
+      - --bind
+      - 0.0.0.0:5001
+      - --workers
+      - "4"
+      - --timeout
+      - "60"
+      - --access-logfile
+      - "-"
+      - --error-logfile
+      - "-"
+      - --certfile
+      - /app/certs/server.crt
+      - --keyfile
+      - /app/certs/server.key
+      - wsgi:app
+    healthcheck:
+      # Match the TLS listener: probe over https and accept the self-signed cert
+      # (-k). The Dockerfile default probes http and would stay red once gunicorn
+      # only speaks TLS.
+      test: ["CMD", "curl", "--silent", "--insecure", "https://localhost:5001/api/auth/login",
+             "-X", "POST", "-H", "Content-Type: application/json", "-d", "{}"]
+      interval: 30s
+      timeout: 5s
+      start_period: 10s
+      retries: 3
     volumes:
       - ./plugins:/app/plugins:ro
+      # Self-signed TLS material for the dev/test https listener. Read-only;
+      # generated on the host under ./certs and never baked into the image.
+      - ./certs:/app/certs:ro
       # /app/instance is WRITTEN state, not code: plugins.json (which plugins
       # this site has enabled), uploaded floor plans, branding, model and
       # application images, employee photos, warranty proofs, slides,