feat(autopromote): add force_install_allowlist to scope forced-install deadlines (ITCPE-3447)

[matt-henson-gusto]

Summary

Adds an optional force_install_allowlist to autopromote so force_install_after_date deadlines can be scoped to a small set of packages — letting us pilot forced installs before going fleet-wide. Draft for ITCPE-3447 (MSC forced-update project).

Why

Today, when enforce_force_install_date is on, every promoted pkginfo (minus force_install_denylist) gets a deadline. There's no way to pilot deadlines on a few apps without denylisting everything else. This is the missing primitive to align the deadline rollout with the cpe_msc_nudge graceful-enforce allowlist (Chrome first).

Change

force_install_allowlist = CONFIG.get("force_install_allowlist", [])
in_force_install_scope = not force_install_allowlist or name in force_install_allowlist
if CONFIG.get("enforce_force_install_date") and in_force_install_scope
   and name not in force_install_denylist:
    # stamp force_install_after_date

• Non-empty allowlist: only those names get a deadline.
• Empty / absent: unchanged — all promoted items get a deadline (minus denylist). Fully backward-compatible.
• force_install_denylist still excludes even allowlisted names.

Documented in README.md + the sample autopromote.json.

Validation

• py_compile clean; sample config valid JSON.
• No behavior change when force_install_allowlist is empty/absent (the current production state).
• Validated 2026-06-23 against a throwaway munki repo (Chrome + Slack + Zoom in canary, all due for promotion): only GoogleChrome-125.0.0.plist received force_install_after_date: 2026-07-02 14:30:31; Slack and Zoom promoted clean with no deadline stamped. Allowlist scoping confirmed end-to-end.

Paired with

cpe-autopkg-pipeline config PR that turns this on for the Chrome pilot. Merge this first — the config PR enables enforce_force_install_date, which without this change would stamp deadlines on all apps.

Local testing complete. Ready for review.