Fix endpoint user-context collection running in the wrong session

Mapped drives reported Unavailable on endpoints where the operator could
see them fine. The data path was intact; the collection was running under
the wrong token. Mapped drives are per logon token, so an elevated probe
enumerates a different drive table than the interactive user.

Collection:
- Pin the user-context spool path so the probe and service agree on one
  location, and persist/overwrite it instead of deleting on read.
- Refuse to collect while elevated (exit code 2) rather than emitting a
  confident wrong answer, and stamp elevated/username on the spool.
- Reject spools stamped elevated or from an unexpected account on read,
  so an admin run cannot masquerade as valid.
- Log netuse/smbmapping/userlistener counts so each run leaves evidence
  of what it actually saw.

Install and launch context:
- Move collection to a 'ShopDB user-context probe' scheduled task under
  S-1-5-32-545 at RunLevel Limited, the only mechanism that reliably runs
  in the operator's own session. Verify registration and record it in the
  install ledger.
- Stop starting the tray as a child of the elevated installer; explorer.exe
  de-elevates without changing ACCOUNT, so an admin install produced an
  admin tray. The Run key only fires at logon, which left the tray dead on
  a machine already signed in, so add a transient 'ShopDB tray first launch'
  task that starts it once in the existing session and unregisters itself.
- Hide the console window during --collect-usercontext. The agent is a
  console exe; the tray used to mask this with CreateNoWindow, but the
  scheduled task invokes it directly and flashed a window every cycle.

Installer edits are in _install_script() in plugins/endpoints/api/siteagent.py,
which generates the install.ps1 that actually ships. The standalone
agent/installer/install-shopdbagent.ps1 was never shipped once the package
moved to the UI builder and is deleted here to stop the divergence that
caused an earlier fix to land in a file no endpoint ever ran.

Versions: agent 1.10.1, tray 1.3.0. These share the pinned spool path and
must be deployed together.

Pre-existing test failures unrelated to this work (8, identical on a clean
tree): docs publishable/versions, plugin contract symlink scan, import
guard tamper check, security headers upload sandbox, and three endpoint
timestamp tests.

agent/README.md

@@ -84,12 +84,23 @@ event channel and system WMI.
 ## Tray app (system-tray icon)
 
 The tray is a per-user process, not a service, so it starts at sign-in rather
-than under `sc.exe`. `install-shopdbagent.ps1` handles it: it copies
-`shopdb-endpoint-tray.exe` next to the agent, registers an HKCU logon autostart
-(`Software\Microsoft\Windows\CurrentVersion\Run\ShopDbEndpointTray`), and
-launches it for the current user. Run the installer from the operator's own
-session so the autostart lands in the right user hive. Pass `-NoTray` for a
-headless, service-only install.
+than under `sc.exe`. The generated `install.ps1` handles it: it copies
+`shopdb-endpoint-tray.exe` next to the agent and registers a machine-wide logon
+autostart (`HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ShopDbEndpointTray`,
+64-bit view). The installer deliberately does NOT start the tray itself: it runs
+elevated, so any process it starts inherits an admin token, and mapped drives are
+per logon token - an elevated tray probes the wrong drive table. The Run key only
+fires at logon, which would leave the tray dead until sign-out on a machine
+someone is already using, so the installer also registers a transient
+`ShopDB tray first launch` scheduled task under `S-1-5-32-545` at `RunLevel
+Limited`, runs it once, and unregisters it. That task is the only mechanism that
+can reach into an existing interactive session without carrying the installer's
+token. Pass `-NoTray` for a headless, service-only install.
+
+User-context collection does not depend on the tray. The installer registers a
+`ShopDB user-context probe` scheduled task against the Users group at
+`RunLevel Limited`, which runs `shopdbagent.exe --collect-usercontext` in the
+operator's own session at logon and every 30 minutes.
 
 Right-click the tray icon for:
 
@@ -143,7 +154,7 @@ logic itself changes.
 
 ## Diagnostics
 
-- Rolling file log: `%ProgramData%\ShopDB\EndpointAgent\logs\agent-YYYYMMDD.log`
+- Rolling file log: `%ProgramData%\ShopDB\EndpointAgent\logs\YYYYMMDD-agent.log`
   (14-day retention).
 - Windows Event Log: agent runtime failures and unhandled exceptions are written
   to the `Application` log under source `ShopDB Endpoint Agent`. The source is