Merge the wilm delivery work into main

Ben Baker's installed-software collection, software delivery (run_script and
update_app), agentless adoption tool and command-queue hardening, with his
authorship preserved.

Reviewed before promotion. Fixed: the endpoints plugin tests were never collected
by pytest, the SBOM snapshot table's key would exhaust on MySQL, ingest did not
truncate two columns strict MySQL would reject, and update_app's version branch
pinned a digest for a file that route never serves. Agent packaging moved off
require_role('admin') onto a new endpoints.agentpackage permission.

Contract 0.27.0. Full suite 2231, frontend 314.

shopdb/__init__.py

@@ -93,7 +93,12 @@ from .plugins import plugin_manager
 # as a heading - "Endpoints with crashes or shutdowns" - which as a row badge
 # ran wider than the hostname it qualified. Optional, defaults to the title, so
 # a plugin that does not declare one is unaffected. Additive field, minor bump.
-__contract_version__ = '0.26.0'
+# 0.27.0: added Script to shopdb.api so a plugin can read the ShopDB-hosted
+# script library that backs endpoint run_script delivery without importing core
+# model internals. The endpoints plugin resolves a delivered script by name and
+# serves its body by digest to the agent. Additive name on the surface, minor
+# bump.
+__contract_version__ = '0.27.0'
 
 # Product release version (see ADR-007). The product version and the
 # plugin-contract version above are distinct series with independent
@@ -261,6 +266,7 @@ CORE_BLUEPRINT_NAMES = (
     'dashboard',
     'dashboarddefaults',
     'applications',
+    'scripts',
     'supportteams',
     'search',
     'reports',