security: contain physical miner commands in Stage A

Disable physical control through legacy HTTP/M30 producers, typed admission,
queue dispatch and upgraded Windows executors. Restrict diagnostic transports
to exact read-only operations, with ordinal PowerShell validation before sockets.

Retire unsupported pending/claimed work with atomic, idempotent security audits.
Preserve prior delivery evidence and report unknown outcomes after a prior claim,
including explicitly repaired pending rows. Include containment, cancellation,
concurrency and malformed-payload regressions and the old-Agent cutover runbook.

Validation: independent final application-security revalidation PASS. Two unchanged
baseline source-assertion failures are documented as exceptions. Production release
still requires native Windows validation and verified fencing/stop/drain/upgrade;
server cancellation alone cannot revoke a cached command held by an old Agent.

scripts/test-miner-control.sh

@@ -16,7 +16,7 @@ cleanup() {
 }
 trap cleanup EXIT
 [[ -f .env.dev ]] || { echo "Missing .env.dev" >&2; exit 1; }
-for source_file in backend/tests/test_agent_auth.py backend/tests/test_miner_control.py backend/tests/test_agent_commands.py backend/tests/test_miner_control_postgres.py; do
+for source_file in backend/tests/test_agent_auth.py backend/tests/test_miner_control.py backend/tests/test_agent_commands.py backend/tests/test_miner_control_postgres.py backend/tests/test_legacy_control_retirement.py; do
     permissions="$(stat -c '%a' "${source_file}")"
     (( (10#${permissions} % 10) & 4 )) || {
         echo "${source_file} is not readable by the non-root test container" >&2
@@ -47,6 +47,7 @@ done
         tests.test_agent_auth \
         tests.test_miner_control \
         tests.test_agent_commands \
+        tests.test_legacy_control_retirement \
         tests.test_miner_control_postgres
 
 echo "Miner Control Foundation focused tests passed."

scripts/test-stage-a-security.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Run inside an isolated test environment with a freshly migrated disposable DB.
+# No service creation, cleanup, miner commands, or production defaults.
+set -euo pipefail
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "${repo_root}/backend"
+[[ "${MINEROPS_STAGE_A_DISPOSABLE:-}" == 1 ]] || {
+    echo "Require MINEROPS_STAGE_A_DISPOSABLE=1 and an isolated test database." >&2
+    exit 1
+}
+export PYTHONDONTWRITEBYTECODE=1
+export MINEROPS_ENABLE_REAL_REBOOT=false
+export MINEROPS_ENABLE_REAL_POWER_CONTROL=false
+python -c 'from app.config import settings; assert settings.postgres_db.startswith("minerops_stage_a_"), "Refusing non-Stage-A database"'
+python -m unittest -v \
+    tests.test_legacy_control_retirement \
+    tests.test_stage_a_containment \
+    tests.test_stage_a_containment_postgres \
+    tests.test_stage_a_delivery_evidence \
+    tests.test_stage_a_delivery_evidence_postgres \
+    tests.test_stage_a_schedule_cancellation_postgres \
+    tests.test_agent_zones_postgres \
+    tests.test_miner_control \
+    tests.test_agent_commands.AgentCommandServiceTests \
+    tests.test_agent_commands.AgentCommandRouterTests
+# Separately run agents/windows/tests/Test-MinerOpsControl.ps1 in a network-free
+# PowerShell environment, then Test-MinerOpsDiagnosticTransport.ps1. Both load
+# functions only. Diagnostic compatibility listeners bind loopback exclusively.