Merge the wilm delivery work into main

Ben Baker's installed-software collection, software delivery (run_script and
update_app), agentless adoption tool and command-queue hardening, with his
authorship preserved.

Reviewed before promotion. Fixed: the endpoints plugin tests were never collected
by pytest, the SBOM snapshot table's key would exhaust on MySQL, ingest did not
truncate two columns strict MySQL would reject, and update_app's version branch
pinned a digest for a file that route never serves. Agent packaging moved off
require_role('admin') onto a new endpoints.agentpackage permission.

Contract 0.27.0. Full suite 2231, frontend 314.

tests/test_runtime_dependencies.py

@@ -38,6 +38,13 @@ ALLOWED_UNDECLARED = {
     'pip',
     'setuptools',
     'pkg_resources',
+    # python-docx, used ONLY by scripts/docs/generate_docx.py to turn local
+    # authored Markdown into DOCX deliverables in exports/. That script is a
+    # developer convenience: the app never imports it, no deployed site runs it,
+    # and the Markdown it reads is itself gitignored. Declaring it in the
+    # production requirements would ship a doc-generation library to every
+    # customer venv for no runtime purpose.
+    'docx',
 }