Pin the approved content digest on an endpoint command

Delivery descriptors for run_script and update_app are resolved when the
agent claims a command, not when an operator queues it, and the command
row recorded no digest: the enqueue path resolved the descriptor purely
to validate it and threw the result away.

So what an operator approved and what an endpoint runs were two separate
lookups against mutable content, minutes or hours apart. Anyone able to
replace a script body or an installer package could do so in the gap.
The claim then re-resolves, the descriptor faithfully describes the new
bytes, the agent verifies correctly, and it runs as LocalSystem. The
audit trail names the operator who queued the original.

The gate on the verb and the gate on the payload were also different
grants: pushing needs endpoints.deploy, but replacing what gets pushed
needs only applications.edit.

pinnedsha256 records the digest as it stood at enqueue, and the claim
refuses a descriptor that has moved, failing the push with an audit row
instead of shipping it. Null for actions that deliver no content, and
for rows queued before this migration, which claim as before. A
descriptor that vanished entirely is not treated as tampering: that path
already sends the command through undescribed so the agent fails closed.

Separately, a result may now only finalize a command that is actually
running. That needs no agent change and closes two things: reporting on
a command that was never claimed, and overwriting a recorded failure
with a success.

The agent now sends its hostname on the result callback so the server
can check it owns the command it is finalizing. The shared collector key
does not say who is calling, so without it any agent can post a result
for any command id. The server treats the parameter as optional for
agents that predate this and enforces it when present, so there is no
flag day. This is a floor, not a fix: only a per-endpoint credential
makes the caller's identity provable, and that is tracked separately.

The .NET side is unbuilt here and needs a build plus a win11 VM run.

Scope: product

plugins/endpoints/migrations/versions/0005_endpoint_command_pinnedsha256.py

@@ -0,0 +1,51 @@
+"""Pin the approved content digest on an endpoint command.
+
+Delivery descriptors (run_script, update_app) are re-resolved when the agent
+claims a command, not when an operator queues it. Between those two moments the
+underlying script body or installer package can be replaced by anyone who can
+edit the applications catalog, and the descriptor's SHA-256 would then describe
+the NEW bytes: the agent verifies correctly and runs something the operator
+never approved.
+
+pinnedsha256 records the digest as it stood at enqueue. The claim path compares
+and refuses the command if it has moved, so a swap fails the push instead of
+shipping it.
+
+Null for actions that deliver no content, and null on rows queued before this
+migration - those are treated as unpinned and claim as before.
+
+Idempotent: checks the live schema first so a db.create_all() site re-runs clean
+on strict MySQL 8.
+"""
+from alembic import op
+
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = 'endpoints0005cmdpin'
+down_revision = 'endpoints0004apps'
+branch_labels = None
+depends_on = None
+
+
+def _has_column(table_name, column_name):
+    from sqlalchemy import inspect
+
+    inspector = inspect(op.get_bind())
+    if not inspector.has_table(table_name):
+        return False
+    return any(col['name'] == column_name
+               for col in inspector.get_columns(table_name))
+
+
+def upgrade():
+    if not _has_column('endpointcommands', 'pinnedsha256'):
+        op.add_column('endpointcommands',
+                      sa.Column('pinnedsha256', sa.String(length=64),
+                                nullable=True))
+
+
+def downgrade():
+    if _has_column('endpointcommands', 'pinnedsha256'):
+        op.drop_column('endpointcommands', 'pinnedsha256')