security(discovery): enforce Zone isolation and retire unsafe legacy writers

Bind Agent observations, review, enrichment and telemetry to current Zone
and inventory authority. Preserve immutable MAC ownership and historical
snapshots with stale-result rejection and transactional security audits.

Retire unbound direct/range/scheduled discovery and one/bulk legacy summary
writes in both modes. Require reconciled exact inventory identity or
explicit Zone-scoped IP selection for CSV metadata imports.

Independent Blocker #1 application-security re-audit: PASS on tree
cf863aadc9. Evidence: 141 focused PostgreSQL/HTTP
tests passed; Chromium and PowerShell checks passed. Two documented baseline
source assertions remain unchanged. Production deployment is not approved.

agents/windows/EnrichOneMiner.ps1

@@ -2,7 +2,10 @@
     [Parameter(Mandatory=$true)]
     [string]$IpAddress,
 
-    [string]$MinerId = ""
+    [string]$MinerId = "",
+    [string]$DiscoveryId = "",
+    [string]$ObservationVersion = "",
+    [string]$CommandId = ""
 )
 
 $ConfigPath = "C:\MinerOpsAgent\agent-config.json"
@@ -164,6 +167,14 @@ $hubUrl = ([string]$config.hub_url).TrimEnd("/")
 $secret = [string]$config.agent_secret
 $agentId = [string]$config.agent_id
 
+# Revalidate the claimed command against current Hub authority before miner sockets.
+if (!$DiscoveryId -or !$ObservationVersion -or !$CommandId) { throw "discovery_observation_required" }
+$target = Invoke-RestMethod -Method Post -Uri "$hubUrl/api/agent/discovery-target" `
+    -Headers @{ "X-MinerOps-Agent-ID" = $agentId; "X-MinerOps-Agent-Secret" = $secret } `
+    -ContentType "application/json" -Body (@{ discovery_id=$DiscoveryId; version=$ObservationVersion; command_id=$CommandId } | ConvertTo-Json)
+$IpAddress = [string]$target.ip_address
+if (!$target.ok -or !$IpAddress) { throw "discovery_target_denied" }
+
 $commands = @(
     "summary",
     "devs",
@@ -219,6 +230,9 @@ if (!$model) {
 $payload = [ordered]@{
     ip_address = $IpAddress
     miner_id = $MinerId
+    discovery_id = $DiscoveryId
+    version = $ObservationVersion
+    command_id = $CommandId
     mac_address = $mac
     hostname = $hostname
     miner_sn = $minerSn