Track manifest apps in the Applications catalog; make CMM gate contextual

seed-applications: a flask geenforce seed-applications command + service that
reads the imaging-PC-type manifests and creates a core Application for every
installer entry (MSI/EXE/CMD/BAT), so shopdb tracks what GE-Enforce actually
deploys. Idempotent, deduped by appname; File/Registry/PS1/INF config entries
are skipped. Run against the West Jefferson reference: 27 apps tracked (PC-DMIS
2016/2019/2026, eDNC, Oracle Client, Adobe Reader, HostExplorer, the VC++ redist
matrix, Keyence VR-6000, PowerShell, Display Kiosk, ...). 2 tests.

Editor: the CMM version gate (_CmmVersion) now only shows for CMM scopes - it is
metrology-specific, so a printer/common entry form no longer carries the
irrelevant field.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plugins/geenforce/plugin.py

@@ -178,6 +178,27 @@ class GeEnforcePlugin(BasePlugin):
                 db.session.commit()
                 click.echo(f"Published {scopename}/{phase} as v{version}.")
 
+        @geenforce_cli.command('seed-applications')
+        @click.option('--shareroot', required=True)
+        @click.option('--preinstall', default=None)
+        def seed_applications_cmd(shareroot, preinstall):
+            """Track the apps the manifests install in the core Applications catalog."""
+            from flask import current_app
+            from .importer import discover_share, load_manifest_file
+            from .service import seed_applications_from_manifests
+
+            with current_app.app_context():
+                sources = list(discover_share(shareroot))
+                if preinstall:
+                    sources.append(('preinstall', 'preinstall',
+                                    load_manifest_file(preinstall)))
+                result = seed_applications_from_manifests(sources)
+                db.session.commit()
+                click.echo(f"Applications: {len(result['created'])} created, "
+                           f"{len(result['existing'])} already tracked.")
+                for name in result['created']:
+                    click.echo(f"  + {name}")
+
         @geenforce_cli.command('export-share')
         @click.argument('scopename')
         @click.option('--shareroot', required=True)