Merge the wilm delivery work into main

Ben Baker's installed-software collection, software delivery (run_script and
update_app), agentless adoption tool and command-queue hardening, with his
authorship preserved.

Reviewed before promotion. Fixed: the endpoints plugin tests were never collected
by pytest, the SBOM snapshot table's key would exhaust on MySQL, ingest did not
truncate two columns strict MySQL would reject, and update_app's version branch
pinned a digest for a file that route never serves. Agent packaging moved off
require_role('admin') onto a new endpoints.agentpackage permission.

Contract 0.27.0. Full suite 2231, frontend 314.

scripts/gen_openapi.py

@@ -59,7 +59,13 @@ def _product_version():
 
 def _norm_path(p):
     # Flask <int:id> / <id> -> OpenAPI {id}
-    return re.sub(r'<(?:[^:>]+:)?([^>]+)>', r'{\1}', p or '')
+    normalised = re.sub(r'<(?:[^:>]+:)?([^>]+)>', r'{\1}', p or '')
+    # A trailing slash in a published path is a distinct resource to a strict
+    # proxy (IIS), which answers the unslashed URL with a redirect a client
+    # behind a subpath mount cannot follow. Emit the canonical, slashless form.
+    if len(normalised) > 1:
+        normalised = normalised.rstrip('/')
+    return normalised
 
 
 def _security(auth):