v2.4.4

Fix: SNMP-endpoint import now works on tag-scoped syncs

Two independent defects made endpoint import (sync_endpoints) impossible on
any sync that uses a device-tag include scope — publish/refresh could never fix
this:

1. Query-side: the endpoint branch required endpoints to carry the device
   include tags. Endpoints (e.g. Avocent console servers) rarely share device
   scoping tags, so every endpoint was filtered out in Forward. The endpoint
   branch now applies exclude tags only — include scope narrows modeled
   devices, not endpoints.
2. Plugin-side: the local scope filter's device set was built from modeled
   devices only, so endpoint rows were always dropped — and with
   prune-out-of-scope enabled they would even be emitted as deletes. With
   sync_endpoints on, a dedicated endpoint probe (exclude tags honored) now
   unions endpoint names into the scoped set, so the filter and prune keep
   them. If the probe fails, endpoint emission is disabled for that run instead
   of risking deletes.

Validated live reproducing the reported scenario (include tags endpoints don't
carry + endpoint import on): 355 Avocent/console endpoints import under a
tag-scoped sync.

Fix: merge-phase "Tag with this Name already exists" issues

While a merge applies device updates (ordered before creates), device tags are
set by name, creating the tag on main with a new pk; the branch's tag create
then collided on the unique name and surfaced as a ValidationError ingestion
issue. The merge now treats a same-named/same-slug main-side tag as already
merged (differing non-unique attrs converge on the next sync).

No schema or migration changes. Drop-in from 2.4.3.