Add GE-Enforce observed-state reporting: receipt + self-heal from PCs

PCs now report enforcement results back to shopdb, closing the desired-vs-observed
loop.

- POST /api/geenforce/report (geenforce.report service token): each cycle a PC
  posts the published version it applied, install/skip/fail/filtered counts, and
  per-entry outcomes.
- Two tables: manifestenforcementreports (latest-per-host + history: applied
  version, enforcer version, counts, derived status ok/selfhealed/failed) and
  manifestenforcementresults (per entry: action installed/skipped/failed,
  selfhealed flag, exit code, warning/error message).
- RECEIVED: reports carry the applied version; the admin view derives
  receivedlatest by comparing it to the scope's current published version, so
  the fleet view shows which PCs picked up an update.
- SELF-HEAL: per-entry action captures drift correction (installed when it
  should already be present) vs skipped (already good) vs failed, with messages.
- Admin reads: GET /reports (fleet compliance rollup) and GET /reports/<id>
  (per-entry detail). New geenforce.report permission.
- Tables added to the (undeployed) 0001 baseline; geenforce.post_report is a
  service-token endpoint so it is exempt from the JWT authz sweep, like the
  collector blueprint. 8 reporting tests; full suite green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plugins/geenforce/plugin.py

@@ -21,7 +21,8 @@ from .api import geenforce_bp
 from .models import (
     ManifestScope, ManifestEntry, ManifestEntryPcType, ManifestEntryHostname,
     ManifestEntryMachineNumber, ManifestInUseCheck, ManifestInUseCheckProcess,
-    ManifestPublishedVersion, ManifestPayload, PcTypeAlias,
+    ManifestPublishedVersion, ManifestPayload, ManifestEnforcementReport,
+    ManifestEnforcementResult, PcTypeAlias,
 )
 from .filters import ALIAS_GROUPS
 
@@ -61,7 +62,8 @@ class GeEnforcePlugin(BasePlugin):
             ManifestScope, ManifestEntry, ManifestEntryPcType,
             ManifestEntryHostname, ManifestEntryMachineNumber,
             ManifestInUseCheck, ManifestInUseCheckProcess,
-            ManifestPublishedVersion, ManifestPayload, PcTypeAlias,
+            ManifestPublishedVersion, ManifestPayload,
+            ManifestEnforcementReport, ManifestEnforcementResult, PcTypeAlias,
         ]
 
     def get_permissions(self) -> List:
@@ -73,6 +75,8 @@ class GeEnforcePlugin(BasePlugin):
              'geenforce'),
             ('geenforce.fetch', 'Fetch published manifests (client service token)',
              'geenforce'),
+            ('geenforce.report', 'Report enforcement results (client service token)',
+             'geenforce'),
         ]
 
     def init_app(self, app: Flask, db_instance) -> None: