Add configuration policy monitors and action picker for computers

Configuration policies need a way to attach process/service monitors so drift can be evaluated against a machine's desired state. This wires the policy resolver and routes to the shared monitor catalog and adds an action picker UI that can create process monitors with an optional launch path.

plugins/computers/models/__init__.py

@@ -13,6 +13,7 @@ from .policy import (
     BusinessPolicy,
     BusinessPolicyItem,
     POLICY_SOURCE_LOCAL,
+    POLICY_SOURCE_SHIPPED,
     ACTION_MODE_DESIRED,
     ACTION_MODE_GATE,
 )
@@ -28,6 +29,7 @@ __all__ = [
     'BusinessPolicy',
     'BusinessPolicyItem',
     'POLICY_SOURCE_LOCAL',
+    'POLICY_SOURCE_SHIPPED',
     'ACTION_MODE_DESIRED',
     'ACTION_MODE_GATE',
 ]

plugins/computers/models/policy.py

@@ -27,6 +27,12 @@ from .jsontext import JSONText
 # owner. Kept a plain string, not an enum column, so adding a source is data.
 POLICY_SOURCE_LOCAL = 'local'
 
+# Product-owned rows we ship (the shopfloor app monitor bundle). Same read-only
+# treatment as any non-local source: the CRUD API refuses to edit or delete
+# them, the seeder reconciles them. Distinct from 'local' so a site's own
+# policies are never confused with what the product shipped.
+POLICY_SOURCE_SHIPPED = 'shipped'
+
 
 class ConfigurationPolicy(BaseModel):
     """A single reusable policy: a scope plus the actions it applies.