security(discovery): enforce Zone isolation and retire unsafe legacy writers

Bind Agent observations, review, enrichment and telemetry to current Zone
and inventory authority. Preserve immutable MAC ownership and historical
snapshots with stale-result rejection and transactional security audits.

Retire unbound direct/range/scheduled discovery and one/bulk legacy summary
writes in both modes. Require reconciled exact inventory identity or
explicit Zone-scoped IP selection for CSV metadata imports.

Independent Blocker #1 application-security re-audit: PASS on tree
cf863aadc9. Evidence: 141 focused PostgreSQL/HTTP
tests passed; Chromium and PowerShell checks passed. Two documented baseline
source assertions remain unchanged. Production deployment is not approved.

backend/tests/test_agent_zones_postgres.py

@@ -196,12 +196,12 @@ class AgentZonePostgresTests(unittest.TestCase):
             connection.rollback()
             connection.close()
 
-    def test_unassigned_miner_inherits_zone_and_existing_other_zone_wins(self):
+    def test_unassigned_miner_stays_unassigned_and_existing_other_zone_wins(self):
         repository = AgentZoneRepository(connect)
         outcomes = repository.assign_miners_to_zone(
             [MINER_UNASSIGNED, MINER_OTHER], ZONE_A
         )
-        self.assertEqual(outcomes[MINER_UNASSIGNED], "assigned")
+        self.assertEqual(outcomes[MINER_UNASSIGNED], "miner_zone_unassigned")
         self.assertEqual(outcomes[MINER_OTHER], "agent_zone_conflict")
         connection = connect()
         try:
@@ -213,7 +213,7 @@ class AgentZonePostgresTests(unittest.TestCase):
                 assignments = dict(cur.fetchall())
         finally:
             connection.close()
-        self.assertEqual(assignments[MINER_UNASSIGNED], ZONE_A)
+        self.assertIsNone(assignments[MINER_UNASSIGNED])
         self.assertEqual(assignments[MINER_OTHER], ZONE_B)
 
     def test_disabled_zone_blocks_control_without_site_fallback(self):