Merge the wilm work, act on the five-agent review, verify the launch-path policy on Windows

plugins/endpoints/models/endpoint.py

@@ -75,6 +75,13 @@ class EndpointState(db.Model):
     interfacesjson = db.Column(db.Text(length=16777215), nullable=True)
     scheduledtasksjson = db.Column(db.Text(length=16777215), nullable=True)
 
+    # Warn-only reconciler output, refreshed on every agent check-in in the same
+    # commit as servicesjson. Each entry names a policy/shipped-attached monitor
+    # the endpoint is expected to be running but the latest snapshot does not
+    # report as running, so an operator sees the drift and intervenes manually.
+    # This is warn-only: nothing here is auto-remediated. Null = never computed.
+    driftjson = db.Column(db.Text(length=16777215), nullable=True)
+
     # Last-known MTConnect agent run state, cached so the WebUI toggle can show
     # a real state between command polls. Set by the agent's mtconnect_status
     # result. Null = never reported (unknown).