Import the wilm agent store, WINC adoption work and batches CLI, with four fixes

CONTRIBUTING.md

@@ -24,6 +24,24 @@
 - **Index names**: `idx_<table>_<column>`. Underscores allowed here only because indexes are infrastructure, not data.
   - Good: `idx_machines_locationid`
 
+### Migrations and deploy ordering
+
+- **A model change ships WITH its migration in the same change.** Adding or
+  changing a column/table on a SQLAlchemy model without the matching Alembic
+  migration is a broken change, even if it passes tests against a freshly built
+  schema.
+- **Code and schema must never deploy out of step.** A model that references a
+  column its migration has not applied yet makes MySQL raise
+  `1054 Unknown column`, which 500s every query on that table (this is not a
+  degraded read - the whole endpoint fails).
+- **Bringing up a new image MUST run migrations before serving traffic**, in
+  order: `flask db upgrade` (core chain) then `flask plugin upgrade-all`
+  (per-plugin chains). A rebuilt image with new model code but an
+  un-migrated database will 500 until this runs.
+- Core schema lives in `migrations/versions/`; each plugin owns its own chain
+  under `plugins/<name>/migrations/`. New schema = a new migration with an
+  idempotent guard and a real downgrade, clean on strict MySQL 8.
+
 ### Allowed acronyms (closed list, expand by PR)
 
 - **Universal**: `id`, `url`, `api`, `http`, `https`, `json`, `jwt`, `sql`, `os`, `ip`, `dns`, `csv`, `pdf`, `cors`, `ttl`, `uuid`, `html`, `css`, `orm`