…agents (#53)

* cimiimport: add --emit-installs for autopkg installs generation

* wrapper MSI: ARP display_name fallback for detection and verification

* stale-usage: Munki-parity scoping and default-on

- UsageStaleUninstallEnabled now defaults to true; per-item opt-in via
  days_untouched_before_uninstall is still required.
- Scope the pass like Munki unused-software removal: self-serve installs
  and unsubscribed optional items are eligible (subscription cleared via
  AddRemovalRequestAsync so removal sticks but the item stays offered in
  MSC); orphans remain eligible; anything admin-manifested is protected.
- ManifestItem.IsSelfServe marks items whose action came from
  SelfServeManifest; merge now checks all entries for a name so a
  self-serve promotion never masquerades as admin intent.
- Check-only never writes the self-serve manifest.

* stale-usage: ManagedUpdate scope for patch-if-present items

managed_updates expresses no presence intent, so items only listed there
(the provision-then-keep-patched pattern, e.g. Firefox) are eligible for
stale removal. Lingering self-serve install requests are cleared without
filing a removal request the update policy would veto-log. Items already
queued for install/update this run defer evaluation to the next run.

* selfserve merge: managed_updates never vetoes user install/remove

optional_installs + managed_updates is the normal combo for user-owned
but admin-patched software. Only presence-mandating actions (install,
uninstall, default, profile, app) suppress self-serve requests; update
entries are ignored when promoting or flipping the optional entry, and
dedup precedence (install > uninstall > update) keeps the user action
in effect.

* schema: adopt Munki key unused_software_removal_info

Replace the invented flat keys (days_untouched_before_uninstall,
usage_tracked_paths, minimum_usage_history_days) with Munki's nested
dict: unused_software_removal_info { removal_days, paths,
minimum_history_days }. paths is the Windows analog of bundle_ids;
minimum_history_days is a Cimian extension. Clean rename, no aliases:
the flat keys shipped only in v0.0.8 (default off) with no production
pkginfo using them. makepkginfo flags renamed to --unused_removal_days,
--unused_path, --unused_minimum_history_days.

* comments: drop external project references

* stale-usage: reuse one SelfServiceManifestService per pass

Copilot review: constructing the service per stale item rebuilt its YAML
serializers each time and gave each instance its own file-lock semaphore.
Hoist a single lazily-created instance so all subscription mutations in a
run share one serializer state and one lock.

* managedsoftwareupdate: honour OnDemand items (always reinstall, never receipt)

Claude-Session: https://claude.ai/code/session_01AaUS8UfLZJcqodyG6MjLXJ

* managedsoftwareupdate: warn (not debug) when stale OnDemand receipt removal fails

Claude-Session: https://claude.ai/code/session_01AaUS8UfLZJcqodyG6MjLXJ

Advances cli/cimipkg 17694a0 -> 63150e6 so generated MSIs supersede prior same-product builds and always re-lay payload on re-install (cimian-pkg #26), rolling up #23-#25.

Claude-Session: https://claude.ai/code/session_01CpzSpVGbLJG9B9aDrF7mi2

…#61)

* cimiimport: stamp _metadata created_by/creation_date at import (local user + local time)

* cimiimport: do not stamp blank created_by

When USERPROFILE is unset and Environment.UserName is empty (unusual
service/CI hosts), leave created_by absent rather than persisting an
empty string, so the prod-checks missing-metadata backfill can still
fill it later. Addresses Copilot review on #61.

Claude-Session: https://claude.ai/code/session_01Mv9Qx1AMqtGYf6iYFxacHr

…t-wide (#59)

* loopguard: add LoopGuardEnabled config to disable suppression fleet-wide

Adds a global admin opt-out for install-loop prevention. Previously
LoopGuard could only be skipped during bootstrap or bypassed per-package
via --item/--clear-loop; there was no config switch to turn it off
entirely (gap noted in wiki/munki-loopguard-spec.md).

- CimianConfig.LoopGuardEnabled (default true); set false in config.yaml
- LoopGuard gains a `disabled` flag; ShouldSuppress short-circuits when set
- UpdateEngine passes !LoopGuardEnabled and logs when disabled
- Surface value in --show-config
- Tests: disabled guard never suppresses and ignores persisted state
- Document the setting in install-loop-prevention.md

Passive loop detection (items.json reporting) is unaffected.

Claude-Session: https://claude.ai/code/session_01A6em9MeeisDAqNNuiUyQDM

* loopguard: address review on global disable

- UpdateEngine: move the "LoopGuard disabled by config" notice until after
  ConsoleLogger.Verbosity is set and the SessionLogger is attached, so it
  reliably reaches run.log (and the console at -v).
- LoopGuard: short-circuit RecordAttempt when globally disabled so no
  suppression state accumulates. Re-enabling later behaves as if no loop
  history exists instead of instantly suppressing based on disabled-window
  attempts. Passive loop reporting (install_loop_detected) is unaffected --
  it derives from the structured event history, not LoopGuard state.
- Add test for the no-accumulation behavior; soften wiki wording about the
  exact log message and session-log visibility.

Addresses Copilot review on #59.

Claude-Session: https://claude.ai/code/session_01Mv9Qx1AMqtGYf6iYFxacHr

* managedsoftwareupdate: 404 fallback chain for primary manifest (Orphaned/site_default)

* manifest: address review on 404 fallback chain

- Resolve the serial-number candidate lazily so the WMI query only runs
  when the chain actually reaches it (not when the configured identifier
  resolves first or the chain aborts on a non-404).
- Track per-manifest fetch results instead of a processed-name set: a
  manifest that 404s/errors is no longer reported as Ok when referenced
  again as an include of a later catch-all. A tentative Ok still breaks
  circular includes.
- Keep include/LoadSpecificManifestAsync 404s visible (Warn) via a
  quiet404 flag; only the primary fallback chain probes quietly (Debug),
  so the include/specific-manifest semantics are unchanged.

Addresses Copilot review on #58.

Claude-Session: https://claude.ai/code/session_01Mv9Qx1AMqtGYf6iYFxacHr