Merge the wilm delivery work into main

Ben Baker's installed-software collection, software delivery (run_script and
update_app), agentless adoption tool and command-queue hardening, with his
authorship preserved.

Reviewed before promotion. Fixed: the endpoints plugin tests were never collected
by pytest, the SBOM snapshot table's key would exhaust on MySQL, ingest did not
truncate two columns strict MySQL would reject, and update_app's version branch
pinned a digest for a file that route never serves. Agent packaging moved off
require_role('admin') onto a new endpoints.agentpackage permission.

Contract 0.27.0. Full suite 2231, frontend 314.

plugins/endpoints/commands.py

@@ -77,6 +77,22 @@ COMMAND_ALLOWLIST = {
         'label': 'Collect now',
         'description': 'Force the endpoint agent to report fresh telemetry off-cadence.',
     },
+    'run_script': {
+        'label': 'Run script',
+        'description': 'Run a ShopDB-hosted script on the endpoint. The agent '
+                       'fetches the script body by digest using its collector '
+                       'credential and runs it in the script\'s configured '
+                       'context (system or the logged-on user).',
+        'targetkind': 'script',
+    },
+    'update_app': {
+        'label': 'Install/update application',
+        'description': 'Push a ShopDB-hosted installer for an application (by app '
+                       'or by a specific version). The agent fetches the pinned '
+                       'package by digest using its collector credential and runs '
+                       'it silently.',
+        'targetkind': 'app',
+    },
 }
 
 
@@ -85,6 +101,8 @@ COMMAND_ALLOWLIST = {
 # destructive action (a remote reboot) is a heavier grant than a routine toggle.
 ELEVATED_ACTION_PERMISSIONS = {
     'system_restart': 'endpoints.restart',
+    'run_script': 'endpoints.deploy',
+    'update_app': 'endpoints.deploy',
 }