Merge the wilm delivery work into main

Ben Baker's installed-software collection, software delivery (run_script and
update_app), agentless adoption tool and command-queue hardening, with his
authorship preserved.

Reviewed before promotion. Fixed: the endpoints plugin tests were never collected
by pytest, the SBOM snapshot table's key would exhaust on MySQL, ingest did not
truncate two columns strict MySQL would reject, and update_app's version branch
pinned a digest for a file that route never serves. Agent packaging moved off
require_role('admin') onto a new endpoints.agentpackage permission.

Contract 0.27.0. Full suite 2231, frontend 314.

tests/test_docs_versions.py

@@ -23,9 +23,14 @@ import pytest
 REPO = Path(__file__).resolve().parents[1]
 DOCS = REPO / 'docs'
 
+# docs/openapi.json is tracked so the app can serve it at runtime, so docs/
+# exists even on the published mirror where the authored prose is not. Keying
+# the skip off the directory made this module run on the mirror against a
+# prose-less tree and fail. A published checkout is one with no docs/*.md prose,
+# matching the canonical definition in scripts/check-gates-ran.sh.
 pytestmark = pytest.mark.skipif(
-    not DOCS.is_dir(),
-    reason='no docs/ in this checkout - it is excluded from publication')
+    not any(DOCS.glob('*.md')),
+    reason='no docs/ prose in this checkout - it is excluded from publication')
 
 # The map is generated and the changelog records history; both are allowed to
 # carry literal versions. CONTRACT-STABILITY's table is a history of what each