Import the wilm agent store, WINC adoption work and batches CLI, with four fixes

.github/copilot-instructions.md

@@ -67,6 +67,11 @@ name. Spell out: `config context manager request response environment utilities`
   `migrations/versions/`; each plugin owns its own chain under
   `plugins/<name>/migrations/`. New schema = a new migration with an idempotent
   guard and a real downgrade. Migrations must run clean on strict MySQL 8.
+  Any model column/table change ships WITH its migration in the SAME change, and
+  bringing up a new image MUST run `flask db upgrade` then
+  `flask plugin upgrade-all` before serving traffic. A model that references a
+  column its migration has not applied yet 500s every query on that table
+  (`1054 Unknown column`), so code and schema must never be deployed out of step.
 - **Asset model is the platform contract.** Physical things are an `Asset` plus a
   plugin subtype row linked by `assetid` (FK, `ON DELETE CASCADE`). Consumables
   with quantities are standalone tables, not assets.

.github/workflows/publish-images.yml

@@ -76,8 +76,18 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Set up Buildx
+      # Connect to a persistent, out-of-cluster BuildKit deployment instead of
+      # spinning up a builder against a local Docker daemon. The arc-runner-set
+      # pods have no Docker daemon (no /var/run/docker.sock) and cannot run a
+      # privileged DinD sidecar under cluster policy, so we point Buildx at a
+      # remote buildkitd Service. The endpoint is provided as a repo/org secret
+      # (e.g. tcp://buildkit.buildkit.svc.cluster.local:1234), so it is not
+      # hardcoded here. See deploy/ci/buildkit-remote.yaml for the deployment.
+      - name: Set up Buildx (remote BuildKit)
         uses: docker/setup-buildx-action@v3
+        with:
+          driver: remote
+          endpoint: ${{ secrets.BUILDKIT_ENDPOINT }}
 
       - name: Build and push channel image
         uses: docker/build-push-action@v6