Merge the wilm delivery work into main

Ben Baker's installed-software collection, software delivery (run_script and
update_app), agentless adoption tool and command-queue hardening, with his
authorship preserved.

Reviewed before promotion. Fixed: the endpoints plugin tests were never collected
by pytest, the SBOM snapshot table's key would exhaust on MySQL, ingest did not
truncate two columns strict MySQL would reject, and update_app's version branch
pinned a digest for a file that route never serves. Agent packaging moved off
require_role('admin') onto a new endpoints.agentpackage permission.

Contract 0.27.0. Full suite 2231, frontend 314.

frontend/src/api/index.js

@@ -687,6 +687,43 @@ export const applicationsApi = {
   }
 }
 
+// ShopDB-hosted script library. Backs run_script delivery: the agent fetches a
+// script body by digest with its collector credential and runs it in the
+// script's configured run context (system or user).
+export const scriptsApi = {
+  list(params = {}) {
+    return api.get('/scripts', { params })
+  },
+  listAll(params = {}) {
+    return fetchAllPages('/scripts', params)
+  },
+  get(id) {
+    return api.get(`/scripts/${id}`)
+  },
+  create(data) {
+    return api.post('/scripts', data)
+  },
+  update(id, data) {
+    return api.put(`/scripts/${id}`, data)
+  },
+  delete(id) {
+    return api.delete(`/scripts/${id}`)
+  },
+  // script-body upload; backend sets filename/sha256 to the stored payload.
+  uploadBody(id, file, onProgress) {
+    const form = new FormData()
+    form.append('file', file)
+    return api.post(`/scripts/${id}/body`, form, {
+      headers: { 'Content-Type': 'multipart/form-data' },
+      onUploadProgress: event => {
+        if (onProgress && event.total) {
+          onProgress(Math.round((event.loaded * 100) / event.total))
+        }
+      }
+    })
+  }
+}
+
 // Support Teams API (teams + nested contacts)
 export const supportteamsApi = {
   list(params = {}) {