security: contain physical miner commands in Stage A

Disable physical control through legacy HTTP/M30 producers, typed admission,
queue dispatch and upgraded Windows executors. Restrict diagnostic transports
to exact read-only operations, with ordinal PowerShell validation before sockets.

Retire unsupported pending/claimed work with atomic, idempotent security audits.
Preserve prior delivery evidence and report unknown outcomes after a prior claim,
including explicitly repaired pending rows. Include containment, cancellation,
concurrency and malformed-payload regressions and the old-Agent cutover runbook.

Validation: independent final application-security revalidation PASS. Two unchanged
baseline source-assertion failures are documented as exceptions. Production release
still requires native Windows validation and verified fencing/stop/drain/upgrade;
server cancellation alone cannot revoke a cached command held by an old Agent.

backend/tests/test_miner_control_postgres.py

@@ -137,7 +137,7 @@ class MinerControlPostgresTests(unittest.TestCase):
                     """
                     INSERT INTO minerops_agent_command_queue (
                         id, agent_id, command_type, command_status, request_payload, created_at
-                    ) VALUES (%s, %s, 'miner_control', %s, %s, COALESCE(%s, now()))
+                    ) VALUES (%s, %s, 'poll_known_miners_now', %s, %s, COALESCE(%s, now()))
                     """,
                     (command_id, AGENT_ID, status,
                      Jsonb({"schema_version": 1, "miner_id": str(miner_id),
@@ -199,13 +199,22 @@ class MinerControlPostgresTests(unittest.TestCase):
             service.submit_result(AGENT_ID, pending)
 
     def test_atomic_queue_audit_duplicate_live_and_completed_history(self):
-        service = MinerControlService(MinerControlRepository(connect))
-        first = service.queue_control(
+        repository = MinerControlRepository(connect)
+        def queue_control(miner_id, action, *, requested_value, actor_user_id, actor_username):
+            from types import SimpleNamespace
+            from uuid import uuid4
+            return SimpleNamespace(**repository.enqueue_with_audit(
+                operation_id=str(uuid4()), miner_id=miner_id, agent_id=AGENT_ID,
+                actor_user_id=actor_user_id, actor_username=actor_username,
+                request_payload={"schema_version": 1, "miner_id": str(miner_id),
+                                 "action": action, "requested_value": requested_value},
+                audit_payload={"miner_id": str(miner_id), "action": action}))
+        first = queue_control(
             MINER_ID, "suspend", requested_value=None,
             actor_user_id=USER_ID, actor_username="control-test-user",
         )
         with self.assertRaises(MinerControlConflict):
-            service.queue_control(
+            queue_control(
                 MINER_ID, "suspend", requested_value=None,
                 actor_user_id=USER_ID, actor_username="control-test-user",
             )
@@ -223,17 +232,26 @@ class MinerControlPostgresTests(unittest.TestCase):
             connection.commit()
         finally:
             connection.close()
-        second = service.queue_control(
+        second = queue_control(
             MINER_ID, "suspend", requested_value=None,
             actor_user_id=USER_ID, actor_username="control-test-user",
         )
         self.assertNotEqual(first.operation_id, second.operation_id)
 
     def test_audit_failure_rolls_back_queue_row(self):
-        service = MinerControlService(MinerControlRepository(connect))
+        repository = MinerControlRepository(connect)
+        def queue_control(miner_id, action, *, requested_value, actor_user_id, actor_username):
+            from types import SimpleNamespace
+            from uuid import uuid4
+            return SimpleNamespace(**repository.enqueue_with_audit(
+                operation_id=str(uuid4()), miner_id=miner_id, agent_id=AGENT_ID,
+                actor_user_id=actor_user_id, actor_username=actor_username,
+                request_payload={"schema_version": 1, "miner_id": str(miner_id),
+                                 "action": action, "requested_value": requested_value},
+                audit_payload={"miner_id": str(miner_id), "action": action}))
         operation_count_before = self._operation_count()
         with self.assertRaises(Exception):
-            service.queue_control(
+            queue_control(
                 MINER_ID, "suspend", requested_value=None,
                 actor_user_id=UUID("00000000-0000-4000-8000-000000009999"),
                 actor_username="missing-user",