Add Corporate Tools tab, Dell Command actions, and user-context refresh

Corporate Tools tab on PC Details, gated by endpoints.deploy and liveness.
Starts already-registered scheduled tasks; the agent's ScheduledTaskPolicy
allowlist remains the authority on what may actually run.

Dell Command | Update split into two actions (Scan, Apply Updates) because
they have very different consequences. Apply Updates carries a persistent
breakglass warning in the card naming Tanium as the primary update utility,
rendered between the row title and description so it is visible at all times
rather than only in the confirm dialog. Destructive actions keep the typed
RUN confirmation.

Fix scheduledtask_run being stripped by Configuration Policy: the
intersection in ALLOWED_ACTIONS_FOR dropped it on any endpoint whose
effective policy was non-empty, so every Corporate Tools click failed with
"not permitted by policy" regardless of the caller's role. Corporate tools
are role-gated only, via POLICY_EXEMPT_ACTIONS; policy keeps authority over
monitors and service/process primitives.

Fix blank PC Details page: watch(detailtabs) evaluates its source during
setup and read canDeploy before its const declaration, throwing a TDZ
ReferenceError that aborted setup with no API request made.

Mapped-drive refresh moves to the tray. SYSTEM cannot probe user-scoped
drives, so the service requests a re-probe over a named event and waits for
the spool collectedat stamp to advance before collecting. The probe task is
registered as a ShopFloor user principal; the Users-group principal remains
only as a degraded fallback since a group member cannot start it.

plugins/endpoints/plugin.py

@@ -54,7 +54,7 @@ KNOWN_PAYLOAD_KEYS = frozenset({
     'scheduledtasks', 'applications', 'events',
     'disks', 'bios', 'memory', 'processor', 'osinfo', 'domain',
     'pendingreboot', 'usercontext', 'diskhealth',
-    'rebootreasons', 'bootinfo', 'defender',
+    'rebootreasons', 'bootinfo', 'defender', 'dellupdates',
 })
 
 
@@ -182,12 +182,32 @@ class EndpointsPlugin(BasePlugin):
             # remote reboot is a strictly heavier grant than a routine toggle.
             ('endpoints.restart',
              'Restart endpoint computers (destructive)', 'endpoints'),
-            # Elevated grant for software delivery (run_script, update_app).
+            # Elevated grant for software delivery (run_script, update_app) and
+            # for starting approved scheduled tasks (scheduledtask_run).
             # Required IN ADDITION to endpoints.command by the enqueue route, so
             # running a staged script or pushing an installer is a strictly
             # heavier grant than a routine service/process toggle.
+            #
+            # NOTE FOR THE ROLES WORK - this wire is pre-built for you.
+            # scheduledtask_run was deliberately mapped onto this EXISTING grant
+            # rather than minting a new permission, so nothing needs migrating.
+            # Be aware that WIDENS what endpoints.deploy means: it used to cover
+            # run_script + update_app, and now also covers starting any task on
+            # the agent's approved-task allowlist. Splitting it out is a one-line
+            # change (add endpoints.corptools here and remap it in
+            # commands.ELEVATED_ACTION_PERMISSIONS) - the enqueue route reads
+            # that table, so no other code changes.
+            #
+            # If you do split it, note the three are NOT equal risk:
+            # scheduledtask_run only starts something already registered on the
+            # endpoint and is allowlisted agent-side; update_app runs a pinned
+            # installer; run_script is arbitrary code that runs as SYSTEM unless
+            # its descriptor pins the user context. run_script is the reason this
+            # grant's description has to stay blunt.
             ('endpoints.deploy',
-               'Run staged scripts and push application installers to endpoints', 'endpoints'),
+               'Run staged scripts, start approved scheduled tasks, and push '
+               'application installers to endpoints (scripts run as SYSTEM; '
+               'grant only to fully trusted operators)', 'endpoints'),
              # Packaging the agent is a heavier grant than deploying to one, and
              # it is not the same job either: the generated ZIP carries a live
              # collector key stamped into its install script, so whoever holds
@@ -1113,6 +1133,13 @@ class EndpointsPlugin(BasePlugin):
         if 'defender' in payload:
             state.defenderjson = _as_json(payload.get('defender'))
 
+        # Presence-guarded like the probe output below: the agent omits the key
+        # entirely when the collector utility is not installed, and overwriting
+        # to null there would discard a still-valid scan result from before the
+        # utility was removed.
+        if 'dellupdates' in payload:
+            state.dellupdatesjson = _as_json(payload.get('dellupdates'))
+
         # Session-scoped probe output. The agent repeats its last result between
         # probe runs and omits the key entirely when nobody is signed in, so the
         # presence guard preserves the last known mapped drives across an