security: contain physical miner commands in Stage A

Disable physical control through legacy HTTP/M30 producers, typed admission,
queue dispatch and upgraded Windows executors. Restrict diagnostic transports
to exact read-only operations, with ordinal PowerShell validation before sockets.

Retire unsupported pending/claimed work with atomic, idempotent security audits.
Preserve prior delivery evidence and report unknown outcomes after a prior claim,
including explicitly repaired pending rows. Include containment, cancellation,
concurrency and malformed-payload regressions and the old-Agent cutover runbook.

Validation: independent final application-security revalidation PASS. Two unchanged
baseline source-assertion failures are documented as exceptions. Production release
still requires native Windows validation and verified fencing/stop/drain/upgrade;
server cancellation alone cannot revoke a cached command held by an old Agent.

backend/app/identity.py

@@ -708,6 +708,8 @@ def machine_agent_request(path: str) -> bool:
         "/api/agent/pool-snapshots",
         "/api/agent/commands/pending",
         "/api/agent/commands/result",
+        "/api/agent/commands/pending-disabled-old",
+        "/api/agent/commands/result-disabled-old",
         "/api/agent/discoveries",
         "/api/agent/miner-enrichment",
         "/api/agent/miner-enrichment-v2",
@@ -760,6 +762,19 @@ def component_request(path: str) -> bool:
 
 def required_api_permission(method: str, path: str) -> str | None:
     parts = path.split("/")
+    if method == "POST" and path == "/api/dashboard/m30-command-test-lab/run":
+        return "miners.control"
+    if method == "POST" and path == "/api/tools/whatsminer-read-test":
+        return "miners.control"
+    if method == "POST" and path in {
+        "/api/dashboard/scheduled-bulk-actions",
+        "/api/dashboard/scheduled-bulk-actions/process-due",
+    }:
+        return "miners.control"
+    if (method == "POST" and len(parts) == 6
+            and parts[:4] == ["", "api", "dashboard", "scheduled-bulk-actions"]
+            and parts[5] in {"cancel", "delete"}):
+        return "miners.control"
     if (
         len(parts) >= 5
         and parts[:3] == ["", "api", "miners"]