Gate endpoint UI refresh on fresh telemetry and land endpoint agent

A command reaching 'succeeded' only proves the agent ran the action, not that it posted a new telemetry snapshot. Reloading panels on command success alone re-rendered stale service/process rows, so a stopped process could still show running right after Refresh Status.

Add a lightweight telemetrymeta probe exposing lastreportedat and gate both the header Refresh Status action and inline row Start/Stop on that stamp advancing past a pre-action baseline. Polling is bounded so an offline or idle agent never hangs the button, and messaging distinguishes a confirmed refresh from a queued one.

Bring the .NET endpoint agent source (service, tray, installer) into the repo so Cameron can merge and test, with an agent/.gitignore keeping bin/obj/publish out. Includes the DncMain launch-path fix, tray single-file host env scrub, and best-effort file logger.

frontend/src/components/pluginAssetPanels.js

@@ -29,10 +29,20 @@ export function humanize(key) {
 
 export function rows(panel) {
   const data = panel._data
-  if (Array.isArray(data)) return data
-  if (data && Array.isArray(data.rows)) return data.rows
-  if (data && Array.isArray(data.items)) return data.items
-  return []
+  let list
+  if (Array.isArray(data)) list = data
+  else if (data && Array.isArray(data.rows)) list = data.rows
+  else if (data && Array.isArray(data.items)) list = data.items
+  else return []
+  // Optional panel-level row filter so two panels can share one endpoint feed
+  // and each show a slice of it (for example Tracked Services vs Tracked
+  // Processes off the same services snapshot). Absent filter = all rows.
+  const filter = panel.filter
+  if (filter && filter.key) {
+    const want = String(filter.equals).toLowerCase()
+    return list.filter((item) => String(item[filter.key]).toLowerCase() === want)
+  }
+  return list
 }
 
 export function mapTitle(panel, item) {