Merge the wilm work, act on the five-agent review, verify the launch-path policy on Windows

docker-compose.yml

@@ -99,6 +99,11 @@ services:
       retries: 3
     volumes:
       - ./plugins:/app/plugins:ro
+      # Standalone operator scripts shipped inside generated bundles (the
+      # endpoint-agent uninstaller). Read-only, same pattern as plugins: the
+      # site-agent packaging route reads uninstall-shopdbagent.ps1 from here at
+      # download time, so it must be visible in the container.
+      - ./scripts:/app/scripts:ro
       # Self-signed TLS material for the dev/test https listener. Read-only;
       # generated on the host under ./certs and never baked into the image.
       - ./certs:/app/certs:ro