Pin the approved content digest on an endpoint command

Delivery descriptors for run_script and update_app are resolved when the
agent claims a command, not when an operator queues it, and the command
row recorded no digest: the enqueue path resolved the descriptor purely
to validate it and threw the result away.

So what an operator approved and what an endpoint runs were two separate
lookups against mutable content, minutes or hours apart. Anyone able to
replace a script body or an installer package could do so in the gap.
The claim then re-resolves, the descriptor faithfully describes the new
bytes, the agent verifies correctly, and it runs as LocalSystem. The
audit trail names the operator who queued the original.

The gate on the verb and the gate on the payload were also different
grants: pushing needs endpoints.deploy, but replacing what gets pushed
needs only applications.edit.

pinnedsha256 records the digest as it stood at enqueue, and the claim
refuses a descriptor that has moved, failing the push with an audit row
instead of shipping it. Null for actions that deliver no content, and
for rows queued before this migration, which claim as before. A
descriptor that vanished entirely is not treated as tampering: that path
already sends the command through undescribed so the agent fails closed.

Separately, a result may now only finalize a command that is actually
running. That needs no agent change and closes two things: reporting on
a command that was never claimed, and overwriting a recorded failure
with a success.

The agent now sends its hostname on the result callback so the server
can check it owns the command it is finalizing. The shared collector key
does not say who is calling, so without it any agent can post a result
for any command id. The server treats the parameter as optional for
agents that predate this and enforces it when present, so there is no
flag day. This is a floor, not a fix: only a per-endpoint credential
makes the caller's identity provable, and that is tracked separately.

The .NET side is unbuilt here and needs a build plus a win11 VM run.

Scope: product

plugins/endpoints/models/endpoint.py

@@ -172,6 +172,19 @@ class EndpointCommand(db.Model):
     # Who queued it (userid) for audit; the agent never sees this.
     requestedby = db.Column(db.Integer, nullable=True)
 
+    # The content digest as it stood WHEN AN OPERATOR APPROVED THIS PUSH.
+    #
+    # Delivery descriptors are re-resolved at claim time, minutes or hours
+    # later, so without this the bytes an operator approved and the bytes the
+    # agent runs are two different lookups against mutable content. Whoever can
+    # replace a script body or an installer package could swap it in the gap
+    # and the digest would faithfully describe the new bytes.
+    #
+    # Set at enqueue for run_script and update_app; null for actions that
+    # deliver no content. The claim path refuses a command whose descriptor no
+    # longer matches, so a swap fails the command instead of shipping.
+    pinnedsha256 = db.Column(db.String(64), nullable=True)
+
     # Agent-reported outcome. resultjson holds structured detail (for example
     # the observed MTConnect running state); resultmessage is a short summary.
     resultmessage = db.Column(db.Text, nullable=True)