Merge the wilm delivery work into main

Ben Baker's installed-software collection, software delivery (run_script and
update_app), agentless adoption tool and command-queue hardening, with his
authorship preserved.

Reviewed before promotion. Fixed: the endpoints plugin tests were never collected
by pytest, the SBOM snapshot table's key would exhaust on MySQL, ingest did not
truncate two columns strict MySQL would reject, and update_app's version branch
pinned a digest for a file that route never serves. Agent packaging moved off
require_role('admin') onto a new endpoints.agentpackage permission.

Contract 0.27.0. Full suite 2231, frontend 314.

shopdb/api/__init__.py

@@ -41,6 +41,7 @@ from shopdb.core.models import (
     AuditLog,
     Application,
     AppVersion,
+    Script,
     OperatingSystem,
     AssetRelationship,
     RelationshipType,
@@ -313,6 +314,7 @@ __all__ = [
     'AuditLog',
     'Application',
     'AppVersion',
+    'Script',
     'OperatingSystem',
     'AssetRelationship',
     'RelationshipType',