Add application-driven policy generation with an acknowledgement gate

Ticking "Required on all PCs" now generates a configuration policy that
installs the application on every non-server endpoint it matches, rather
than only flagging a software-compliance report row.

Because that save is a fleet-wide deployment, it requires explicit
acknowledgement. The gate is enforced in the API, not only in the form:
a confirmation dialog that can be sidestepped by POSTing directly is
decoration, not a safeguard. It fires only on the transition INTO the
required state, since re-saving an already-required application deploys
nothing new.

Generated policies carry a new 'autoapp' source. They stay editable, and
hand-editing one transfers ownership to 'local' so it survives a later
uncheck; 'shipped' remains read-only. Existing required applications are
not migrated retroactively - policies are only created on save.

Also adds the monitorable fields that the shipped-policy breakup will
build on, and repairs a mangled non-ASCII byte in copilot-instructions.md
that was failing the style gate.

plugins/computers/models/__init__.py

@@ -14,6 +14,7 @@ from .policy import (
     BusinessPolicyItem,
     POLICY_SOURCE_LOCAL,
     POLICY_SOURCE_SHIPPED,
+    POLICY_SOURCE_AUTOAPP,
     ACTION_MODE_DESIRED,
     ACTION_MODE_GATE,
     PolicyActionHold,
@@ -32,6 +33,7 @@ __all__ = [
     'BusinessPolicyItem',
     'POLICY_SOURCE_LOCAL',
     'POLICY_SOURCE_SHIPPED',
+    'POLICY_SOURCE_AUTOAPP',
     'ACTION_MODE_DESIRED',
     'ACTION_MODE_GATE',
     'PolicyActionHold',

plugins/computers/models/policy.py

@@ -33,6 +33,18 @@ POLICY_SOURCE_LOCAL = 'local'
 # policies are never confused with what the product shipped.
 POLICY_SOURCE_SHIPPED = 'shipped'
 
+# Rows generated FOR US by another surface rather than authored by hand: today
+# the "Required on all PCs" checkbox on an Application. Distinct from 'local' so
+# unchecking the box knows which policy it owns and may safely remove.
+#
+# It doubles as the "untouched" test. An autoapp row is one nobody has
+# customised, so it is safe to delete when the box is unchecked. The moment an
+# admin edits it through the policy CRUD API it becomes 'local' - their work
+# now, not ours - and unchecking warns instead of deleting. That keeps the
+# generated policy convenient without letting it silently destroy hand-authored
+# changes.
+POLICY_SOURCE_AUTOAPP = 'autoapp'
+
 
 class ConfigurationPolicy(BaseModel):
     """A single reusable policy: a scope plus the actions it applies.