Add application-driven policy generation with an acknowledgement gate

Ticking "Required on all PCs" now generates a configuration policy that
installs the application on every non-server endpoint it matches, rather
than only flagging a software-compliance report row.

Because that save is a fleet-wide deployment, it requires explicit
acknowledgement. The gate is enforced in the API, not only in the form:
a confirmation dialog that can be sidestepped by POSTing directly is
decoration, not a safeguard. It fires only on the transition INTO the
required state, since re-saving an already-required application deploys
nothing new.

Generated policies carry a new 'autoapp' source. They stay editable, and
hand-editing one transfers ownership to 'local' so it survives a later
uncheck; 'shipped' remains read-only. Existing required applications are
not migrated retroactively - policies are only created on save.

Also adds the monitorable fields that the shipped-policy breakup will
build on, and repairs a mangled non-ASCII byte in copilot-instructions.md
that was failing the style gate.

plugins/computers/models/__init__.py

@@ -14,6 +14,7 @@ from .policy import (
     BusinessPolicyItem,
     POLICY_SOURCE_LOCAL,
     POLICY_SOURCE_SHIPPED,
+    POLICY_SOURCE_AUTOAPP,
     ACTION_MODE_DESIRED,
     ACTION_MODE_GATE,
     PolicyActionHold,
@@ -32,6 +33,7 @@ __all__ = [
     'BusinessPolicyItem',
     'POLICY_SOURCE_LOCAL',
     'POLICY_SOURCE_SHIPPED',
+    'POLICY_SOURCE_AUTOAPP',
     'ACTION_MODE_DESIRED',
     'ACTION_MODE_GATE',
     'PolicyActionHold',