Fix user-context collection, split agent log destinations, widen upload cap

Mapped drives stopped reporting because the user-context path failed silently
in three separate places, and none of them left a trace to read back.

- Probe: launch via -EncodedCommand instead of staging a temp .ps1 and running
  powershell.exe -File. A missing or quarantined script file fails BEFORE any
  statement runs, so the script's own try/catch never sees it and the only
  symptom is exit -196608.
- Spool: pin to the ShopFloor profile. Resolving it through WTSQueryUserToken
  is privileged, endpoint protection blocks it, and on failure the tray
  (writer) and service (reader) silently disagree about the path.
- Spool: consume after a successful parse, so a stopped tray cannot keep
  re-reporting stale mapped drives as current. Unparseable files are left in
  place for the next cycle.
- Logging: user-session components cannot write to Program Files or to the
  SYSTEM-owned ProgramData log directory, and the file sink degrades to a
  silent no-op when it cannot create its directory. Tray and probe now log to
  C:\Users\ShopFloor\ShopDB\Logs, installs transcript to ProgramData, and the
  sink records a SinkProblem instead of swallowing UnauthorizedAccessException.
- Installer: provision the operator spool/log directories with ShopFloor:Modify
  before the tray first runs, and stop the transcript via trap so a throw
  cannot orphan exactly the failed install worth reading.
- Upload cap 64 -> 128 MB: the self-contained tray publishes at ~69 MB and was
  rejected on SIZE, but the size check returns before the PE is parsed, so the
  operator only ever saw a version-detection failure.

AGENT-CONTRACT.md gains a normative section defining the three security
contexts, their log destinations, the fixed spool path and consume-on-read.

Agent 1.8.0 -> 1.8.1, tray 1.1.0 -> 1.1.1 so the deployed build is
identifiable from a log line.

frontend/src/components/PluginAssetPanels.vue

@@ -446,6 +446,15 @@ const props = defineProps({
   // the detail pages that have not adopted tabs still do - so this stays
   // additive and no existing page changes behaviour.
   group: { type: String, default: null },
+  // Render exactly these panel ids, ignoring group. For lifting one card out
+  // of its tab and showing it somewhere else - Network Interfaces is pinned to
+  // the top of Details while still belonging to monitors. Kept as a panel-id
+  // filter rather than a new group because a group would need the four-file
+  // vocabulary change AND would add a tab nobody asked for.
+  only: { type: Array, default: null },
+  // The other half of `only`: the group instance must drop what was lifted out
+  // of it, or the card renders twice on two different tabs.
+  exclude: { type: Array, default: null },
 })
 
 const panels = ref([])
@@ -466,9 +475,14 @@ function groupOf(panel) {
   return RENDERED_GROUPS.includes(panel.group) ? panel.group : 'details'
 }
 
-const groupedPanels = computed(() =>
-  props.group ? panels.value.filter((p) => groupOf(p) === props.group) : panels.value
-)
+const groupedPanels = computed(() => {
+  if (props.only) return panels.value.filter((p) => props.only.includes(p.id))
+  let list = props.group
+    ? panels.value.filter((p) => groupOf(p) === props.group)
+    : panels.value
+  if (props.exclude) list = list.filter((p) => !props.exclude.includes(p.id))
+  return list
+})
 
 // Which groups actually have a panel with data, so a parent can hide a tab
 // rather than offering an empty one.