Merge the wilm endpoint-monitor and channel-distribution work into main

Six commits from wilm-import: the squashed import, route documentation, the
channel remap onto our tag-and-trunk model, the project map, parallel test
support, and the four smaller review findings.

Merged rather than cherry-picked: the published mirror rewrites hashes, so the
commits do not apply one at a time against our history even though the squashed
diff applies clean.

Scope: product

# Conflicts:
#	docs/PROJECT-MAP.md

tests/test_core/test_authz.py

@@ -98,7 +98,15 @@ EXEMPT_ENDPOINTS = {'knowledgebase.track_click', 'users.update_user',
                     # kill switch. Enqueue (WebUI -> operator) IS permission-gated
                     # on endpoints.command and IS swept. Contract in
                     # plugins/endpoints/AGENT-CONTRACT.md section 7.
-                    'endpoints.report_command_result'}
+                    'endpoints.report_command_result',
+                    # Agent-facing operator issue report upload. Authenticated by
+                    # the endpoints collector API key (same shape as the exempt
+                    # collector blueprint), not JWT+role: the tray hands the
+                    # screenshot and note to the service, which uploads on the
+                    # collector key it already holds. The human-facing read and
+                    # image-serve routes ARE permission-gated on endpoints.view
+                    # and ARE swept.
+                    'endpoints.upload_operator_report'}
 
 
 @pytest.fixture(autouse=True)

tests/test_core/test_public_read_surface.py

@@ -96,6 +96,14 @@ PUBLIC_ENDPOINTS = {
     'endpoints.download_app_package',
     'endpoints.download_app_package_by_app',
     'endpoints.download_script_body',
+
+    # The endpoint agent fetches its server-resolved monitor watch-list (the
+    # processes/services site policy attaches to its PC type) on each telemetry
+    # cycle. Authenticated inside the handler by the endpoints collector API key
+    # - the same shape as claim_next_command - because a bay has no user session.
+    # It is a read of already-scoped policy output, not an authority: attaching a
+    # monitor is gated on the policy editor, audited with the requesting user.
+    'endpoints.resolved_monitors_for_agent',
 }
 
 # Reads that need a LOGIN but no named permission, because the handler decides