Patch policies: Always scoped to hosts that have the software installed already

[noahtalerman]

• @noahtalerman: In dogfood, we're adding labels to patch policies to work around this: https://github.com/fleetdm/fleet/blob/main/it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml

Goal

User story
As an IT admin,
I want patch policies to be automatically scoped to hosts that have the software installed already
so that the policies only show up on end users' Fleet Desktop if they have the app installed.

Changes

Product

• UI changes: TODO
• CLI (fleetctl) usage changes: TODO
• YAML changes: TODO
• REST API changes: TODO
• Fleet's agent (fleetd) changes: TODO
• Fleet server configuration changes: TODO
• Exposed, public API endpoint changes: TODO
• fleetdm.com changes: TODO
• GitOps mode UI changes: TODO
• GitOps generation changes: TODO
• Activity changes: TODO
• Permissions changes: TODO
• Changes to paid features or tiers: TODO
• My device and fleetdm.com/better changes: TODO
• Usage statistics: TODO
• Other reference documentation changes: TODO
• First draft of test plan added
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• Contributor API changes: TODO
• Feature guide changes: TODO
• Database schema migrations: TODO
• Load testing: TODO
• Pre-QA load test: TODO
• Load testing/osquery-perf improvements: TODO
• This is a premium only feature: Yes / No

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

Risk assessment

• Requires testing in a hosted environment: TODO
• Requires load testing: TODO
• Risk level: Low / High TODO
• Risk description: TODO

Test plan

Make sure to go through the list and consider all events that might be related to this story, so we catch edge cases earlier.

Core flow

• TODO
• TODO
• TODO

UI

• Verify that all UI changes specified in the Figma wireframes are correctly implemented
• Verify expected UI states (loading, empty, error states if applicable)

API

• Test all API endpoints added or modified in the API changes section of this issue
• Verify any new API endpoints appear in the list when adding an API-only user. The API endpoints display name, method, and path is the same as listed in the API reference docs
• Verify error handling for invalid inputs where applicable

GitOps (generate + run)

• Configure the feature through the UI and run fleetctl generate-gitops
• Confirm the generated .yml includes the expected fields (compare with YAML changes in the Product section)
• Modify the generated .yml and run fleetctl gitops
• Confirm the configuration updates correctly in Fleet
• Enable GitOps mode and verify the feature behaves correctly

Permissions

• Verify role restrictions are applied correctly for global roles
• Verify role restrictions are applied correctly for fleet-level roles

Edge cases

• TODO
• TODO
• TODO

Supplemental testing

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan (include any special setup, test data, or configuration used during development/testing if applicable).
2. QA: Added comment to user story confirming successful completion of test plan.
3. QA: Determined whether this story needs Playwright automation.
   • Needs automation: Yes / No
   • If yes, filed a follow-up issue in the :help-qa project with status "Needs automation": TODO