security(discovery): enforce Zone isolation and retire unsafe legacy writers

Bind Agent observations, review, enrichment and telemetry to current Zone
and inventory authority. Preserve immutable MAC ownership and historical
snapshots with stale-result rejection and transactional security audits.

Retire unbound direct/range/scheduled discovery and one/bulk legacy summary
writes in both modes. Require reconciled exact inventory identity or
explicit Zone-scoped IP selection for CSV metadata imports.

Independent Blocker #1 application-security re-audit: PASS on tree
cf863aadc9. Evidence: 141 focused PostgreSQL/HTTP
tests passed; Chromium and PowerShell checks passed. Two documented baseline
source assertions remain unchanged. Production deployment is not approved.

backend/tests/browser/export_discovery_page.py

@@ -0,0 +1,20 @@
+"""Export the literal production page without importing/startup or network access."""
+
+import ast, json, sys
+from pathlib import Path
+
+root = Path(sys.argv[1])
+tree = ast.parse((root / "backend/app/main.py").read_text())
+node = next(
+    n
+    for n in tree.body
+    if isinstance(n, ast.AsyncFunctionDef) and n.name == "minerops_agent_control_page"
+)
+html = next(
+    n.value
+    for n in ast.walk(node)
+    if isinstance(n, ast.Constant)
+    and isinstance(n.value, str)
+    and "<!doctype html>" in n.value
+)
+Path(sys.argv[2]).write_text(html)