Fix user-context collection, split agent log destinations, widen upload cap

Mapped drives stopped reporting because the user-context path failed silently
in three separate places, and none of them left a trace to read back.

- Probe: launch via -EncodedCommand instead of staging a temp .ps1 and running
  powershell.exe -File. A missing or quarantined script file fails BEFORE any
  statement runs, so the script's own try/catch never sees it and the only
  symptom is exit -196608.
- Spool: pin to the ShopFloor profile. Resolving it through WTSQueryUserToken
  is privileged, endpoint protection blocks it, and on failure the tray
  (writer) and service (reader) silently disagree about the path.
- Spool: consume after a successful parse, so a stopped tray cannot keep
  re-reporting stale mapped drives as current. Unparseable files are left in
  place for the next cycle.
- Logging: user-session components cannot write to Program Files or to the
  SYSTEM-owned ProgramData log directory, and the file sink degrades to a
  silent no-op when it cannot create its directory. Tray and probe now log to
  C:\Users\ShopFloor\ShopDB\Logs, installs transcript to ProgramData, and the
  sink records a SinkProblem instead of swallowing UnauthorizedAccessException.
- Installer: provision the operator spool/log directories with ShopFloor:Modify
  before the tray first runs, and stop the transcript via trap so a throw
  cannot orphan exactly the failed install worth reading.
- Upload cap 64 -> 128 MB: the self-contained tray publishes at ~69 MB and was
  rejected on SIZE, but the size check returns before the PE is parsed, so the
  operator only ever saw a version-detection failure.

AGENT-CONTRACT.md gains a normative section defining the three security
contexts, their log destinations, the fixed spool path and consume-on-read.

Agent 1.8.0 -> 1.8.1, tray 1.1.0 -> 1.1.1 so the deployed build is
identifiable from a log line.

plugins/endpoints/AGENT-CONTRACT.md

@@ -10,8 +10,8 @@ schema changes, update this file in the same change.
 - Method/URL: `POST {baseurl}/api/collector/endpoints`
 - Auth header: `X-API-Key: <collector key>` (Bearer token also accepted). The
   key is a UI-managed, endpoints-only service token minted from Settings ->
-  Endpoint agent key (section 6). A bootstrap `.env` collector key still works
-  until the first UI key is generated, then it is switched off (section 6). No
+  Endpoint agent key (section 7). A bootstrap `.env` collector key still works
+  until the first UI key is generated, then it is switched off (section 7). No
   querystring fallback.
 - Body: `application/json`, a single flat object (NOT an array). One POST per
   report per endpoint.
@@ -194,10 +194,11 @@ Notes:
   rather than a string match against a Windows enum the server would have to
   keep in sync. `null` means the drive did not answer: unknown, NOT healthy.
   `healthstatus` keeps the human-readable source value alongside it.
-- `usercontext` is gathered by a probe the agent runs inside the signed-in
-  user's session, because mapped drives, user-owned listeners and idle time do
-  not exist in the agent's own LocalSystem session 0. It is omitted when no one
-  is signed in, which is a normal unattended state, not a fault.
+- `usercontext` is gathered by a probe the TRAY runs inside the signed-in
+  operator's session, because mapped drives, user-owned listeners and idle time
+  do not exist in the agent's own LocalSystem session 0. It is omitted when no
+  one is signed in, which is a normal unattended state, not a fault. The
+  security-context split that makes this work is normative; see section 5.
 - `ports` carries LISTENING sockets only. The full connection table is available
   on demand via the `network_connections` command instead, because established
   connections churn constantly and would change every report for no diagnostic
@@ -294,7 +295,49 @@ public sealed class CollectorResponse
 Serializer settings: `DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull`
 so omitted fields are not sent (server upserts only present keys). Send UTC ISO-8601.
 
-## 5. "Build site agent" settings flow (build cadence)
+## 5. Security contexts, spool handoff and log destinations (NORMATIVE)
+
+Three processes run as three different principals. Confusing them is what makes
+`usercontext` silently empty, so the boundaries are fixed by contract.
+
+| Process | Runs as | May write to |
+|---|---|---|
+| Service (`shopdbagent.exe`) | LocalSystem, session 0 | `%ProgramData%\ShopDB\EndpointAgent\logs\agent-<date>.log` |
+| Tray + probe (`shopdb-endpoint-tray.exe`, `shopdbagent.exe --collect-usercontext`) | `ShopFloor` operator, interactive session | `C:\Users\ShopFloor\ShopDB\` and `C:\Users\ShopFloor\ShopDB\Logs\<datetime>-trayagent.log` |
+| Installer (`install-shopdbagent.ps1`) | Elevated admin, one-shot | `%ProgramData%\ShopDB\Logs\<datetime>-shopdbinstalls.log` |
+
+Rules:
+
+1. **The operator cannot write to `C:\Program Files` or to the SYSTEM-owned
+   `%ProgramData%\ShopDB\EndpointAgent\logs`.** Anything running in the user's
+   session MUST log under `C:\Users\ShopFloor\ShopDB\Logs`. The file log sink
+   degrades to a silent no-op when it cannot create its directory, so violating
+   this does not raise an error - it discards the log line and the failure
+   becomes invisible.
+2. **Only the tray collects user context**, because mapped drives, user-owned
+   listeners and idle time are per-session and do not exist in session 0. The
+   service MUST NOT try to descend into the session to collect them.
+3. **The tray WRITES the spool; the service READS it and then REMOVES it.**
+   The service consumes the file after a successful parse, so a tray that has
+   stopped running cannot keep re-reporting stale mapped drives as current. A
+   file that fails to parse (a read that raced the write) is left in place.
+4. **The spool location is fixed at `C:\Users\ShopFloor\ShopDB\usercontext.json`.**
+   Every shop-floor endpoint uses the same local `ShopFloor` account. Resolving
+   it through `WTSQueryUserToken` is a fallback only: that call is privileged,
+   endpoint protection blocks it, and when it fails the writer and reader
+   disagree about the location with no error on either side.
+5. **Losing user context is never fatal.** If the `ShopFloor` profile is absent
+   or unwritable, `usercontext` is omitted and telemetry, commands, inventory
+   and the command channel continue unaffected.
+6. **The installer provisions** `C:\Users\ShopFloor\ShopDB\` and its `Logs`
+   subdirectory with `ShopFloor: Modify` before the tray first runs.
+
+The three log destinations are deliberately separate: an install is one-shot and
+elevated, the service log is a rolling runtime log, and the tray log is the only
+one written from the operator's session. Merging them makes an install
+indistinguishable from runtime behaviour when reading a failure back.
+
+## 6. "Build site agent" settings flow (build cadence)
 
 Goal: an operator in ShopDB Settings produces an instance-locked `.exe` that
 knows its server URL and its collector key, needing no manual config on the
@@ -321,7 +364,7 @@ Open item (from DESIGN-DECISIONS-agent.md 1a): whether `adopt` stays a
 per-report flag or is promoted to a site setting (strict vs self-adopting
 fleet). Default proposed: agent sends `adopt=true` on first run only.
 
-## 6. UI-managed agent key (kill switch)
+## 7. UI-managed agent key (kill switch)
 
 The endpoint agent authenticates with a single UI-managed key scoped to ONLY
 `collector.ingest.endpoints`, so rotating or revoking it stops all
@@ -346,13 +389,13 @@ The bootstrap `.env` key (`COLLECTOR_API_KEY[_ENDPOINTS]`) remains only as a
 first-run path before a UI key exists; it cannot be the runtime kill switch
 because container env is injected at boot and cannot be rotated live.
 
-## 7. Command channel (WebUI -> agent)
+## 8. Command channel (WebUI -> agent)
 
 The WebUI can send an endpoint an ALLOWLISTED command (never an arbitrary
 command string). Delivery is agent-initiated long-poll, so shop-floor PCs open
 no inbound port: the agent makes an outbound request the server holds open until
 a command is queued, runs it locally, and posts the result back. All three
-routes reuse the same endpoints collector key (section 6) via `X-API-Key`, so
+routes reuse the same endpoints collector key (section 7) via `X-API-Key`, so
 the command channel shares the kill switch and adds no second secret.
 
 Allowlisted actions (server source of truth: `plugins/endpoints/commands.py`):