Add Corporate Tools tab, Dell Command actions, and user-context refresh

Corporate Tools tab on PC Details, gated by endpoints.deploy and liveness.
Starts already-registered scheduled tasks; the agent's ScheduledTaskPolicy
allowlist remains the authority on what may actually run.

Dell Command | Update split into two actions (Scan, Apply Updates) because
they have very different consequences. Apply Updates carries a persistent
breakglass warning in the card naming Tanium as the primary update utility,
rendered between the row title and description so it is visible at all times
rather than only in the confirm dialog. Destructive actions keep the typed
RUN confirmation.

Fix scheduledtask_run being stripped by Configuration Policy: the
intersection in ALLOWED_ACTIONS_FOR dropped it on any endpoint whose
effective policy was non-empty, so every Corporate Tools click failed with
"not permitted by policy" regardless of the caller's role. Corporate tools
are role-gated only, via POLICY_EXEMPT_ACTIONS; policy keeps authority over
monitors and service/process primitives.

Fix blank PC Details page: watch(detailtabs) evaluates its source during
setup and read canDeploy before its const declaration, throwing a TDZ
ReferenceError that aborted setup with no API request made.

Mapped-drive refresh moves to the tray. SYSTEM cannot probe user-scoped
drives, so the service requests a re-probe over a named event and waits for
the spool collectedat stamp to advance before collecting. The probe task is
registered as a ShopFloor user principal; the Users-group principal remains
only as a degraded fallback since a group member cannot start it.

tests/test_plugin_migrations.py

@@ -106,7 +106,7 @@ EXPECTED_HEAD_REVISION['warranty'] = 'warranty0002proof'
 # 0013 adds the inventory columns.
 # 0014 adds endpointstates.diskhealthjson, and 0015 adds the system telemetry
 # columns (boot info, reboot reasons, Defender health, NIC link state).
-EXPECTED_HEAD_REVISION['endpoints'] = 'endpoints0015systemtelemetry'
+EXPECTED_HEAD_REVISION['endpoints'] = 'endpoints0016dellupdates'
 
 # Plugins built after the cutover: their 0001 baseline really creates tables the
 # core chain never owned.