security(discovery): enforce Zone isolation and retire unsafe legacy writers

Bind Agent observations, review, enrichment and telemetry to current Zone
and inventory authority. Preserve immutable MAC ownership and historical
snapshots with stale-result rejection and transactional security audits.

Retire unbound direct/range/scheduled discovery and one/bulk legacy summary
writes in both modes. Require reconciled exact inventory identity or
explicit Zone-scoped IP selection for CSV metadata imports.

Independent Blocker #1 application-security re-audit: PASS on tree
cf863aadc9. Evidence: 141 focused PostgreSQL/HTTP
tests passed; Chromium and PowerShell checks passed. Two documented baseline
source assertions remain unchanged. Production deployment is not approved.

scripts/test-discovery-security.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Run ONLY from the isolated review candidate. No .env files or published DB ports.
+set -euo pipefail
+review_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+: "${MINEROPS_REVIEW_BACKEND_IMAGE:?Set an existing Python backend image with requirements installed}"
+docker image inspect "$MINEROPS_REVIEW_BACKEND_IMAGE" >/dev/null
+review_id="minerops-discovery-review-$$-$RANDOM"
+review_network="$review_id-network"
+review_db="$review_id-postgres"
+cleanup() {
+    docker rm -f "$review_db" >/dev/null 2>&1 || true
+    docker network rm "$review_network" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+docker network create --internal "$review_network" >/dev/null
+docker run -d --name "$review_db" --network "$review_network" --network-alias postgres \
+    --tmpfs /var/lib/postgresql/data \
+    -e POSTGRES_DB=discovery_review -e POSTGRES_USER=reviewer \
+    -e POSTGRES_PASSWORD=disposable-review-only postgres:16-alpine >/dev/null
+review_ready=0
+for _ in $(seq 1 40); do
+    if docker exec "$review_db" pg_isready -U reviewer -d discovery_review >/dev/null 2>&1; then review_ready=1; break; fi
+    sleep 0.5
+done
+[[ "$review_ready" == 1 ]]
+run_backend() {
+    docker run --rm --network "$review_network" -v "$review_root:/review:ro" \
+        -w /review/backend -e PYTHONDONTWRITEBYTECODE=1 -e PYTHONPATH=/review/backend \
+        -e POSTGRES_HOST=postgres -e POSTGRES_DB=discovery_review -e POSTGRES_USER=reviewer \
+        -e POSTGRES_PASSWORD=disposable-review-only -e JWT_SECRET_KEY=disposable-review-only \
+        -e MINEROPS_DISCOVERY_DISPOSABLE=1 -e MINEROPS_HUB_MODE=true \
+        -e SCHEDULED_SCAN_ENABLED=false -e MINEROPS_WINDOWS_AGENT_SOURCE=/review/agents/windows \
+        "$MINEROPS_REVIEW_BACKEND_IMAGE" "$@"
+}
+run_backend alembic upgrade head
+run_backend python -m unittest -v tests.test_discovery_security_postgres \
+    tests.test_agent_discovery_isolation_postgres \
+    tests.test_legacy_inventory_security_postgres
+# Browser and PowerShell suites use their own intercepted/loopback transports.
+# See docs/operations/BLOCKER_1_DISCOVERY_REVIEW.txt for exact commands and baseline exceptions.