Merge wilm into wj

Brings in wilm commits:
- Render script surfaces correctly in dark mode
- Stop scripts reporting success after doing nothing
- Correct two gate commands that pass without running
- Gate the script library on the grant that pushes scripts
- Let the policy list edit the rows the API accepts
- Cap plugin revision ids at the 32 chars MySQL stores
- Split shipped monitor bundle into per-monitor policies

Resolved conflict in agent ShopDbEndpointAgent.csproj by merging:
- wilm 1.14.0 script verdict and output capture features
- wj 1.13.1-1.13.5 tray coordination releases
- Bumped to 1.14.1 for coordinated agent+tray release

plugins/endpoints/api/routes.py

@@ -2072,9 +2072,15 @@ def _resolve_run_script(target):
     """Resolve a run_script target to a script delivery descriptor.
 
     Accepts either "script:<scriptid>" or a bare script name. The descriptor
-    carries a collector-authenticated download URL, the body's SHA-256, and the
-    per-script run context (system or user). The agent fetches the body with
-    its collector credential and runs it; the body never crosses the wire.
+    carries a collector-authenticated download URL, the body's SHA-256, the
+    per-script run context (system or user), and the optional folder to run in.
+    The agent fetches the body with its credential and runs it; the body never
+    crosses the wire.
+
+    workingdirectory is sent even when empty so the field is always present in
+    the claim: an agent that receives it and ignores it is then distinguishable
+    from one that never saw it, which matters while agents of both vintages are
+    in the field. errormode rides the same rule, and for the same reason.
     """
     kind, _sep, raw = str(target or '').partition(':')
     script = None
@@ -2102,6 +2108,8 @@ def _resolve_run_script(target):
         'installpath': '/api/endpoints/scriptbody/{}'.format(script.scriptid),
         'sha256': script.sha256,
         'runcontext': script.runcontext,
+        'workingdirectory': script.workingdirectory or '',
+        'errormode': script.errormode or 'default',
     }, None