fix(agent-binding,grants): surface the seat confinement refusal on the grant read (TASK-063)

[lilyshen0722]

What this is

TASK-063's second half: the grant read. #1765 shipped the server-side refusal — the projection
stops injecting the broker into a seat no host can confine, and says so on the daemon's /assigned
row. That field is internal to the daemon: no human sees it. So the person who minted a grant
still had no way to learn that the broker was being withheld from the seat it names.

GET /api/grants/:grantId is where that person looks, and it now reports it:

"grantBrokerRefusal": { "code": "grant_broker_unconfined", "decidedBy": "server",
                        "reason": "adapter_cannot_confine", "detail": "…" },
"grantBrokerRefusalScope": "seat"

The scope is the honesty mechanism, and it is four-valued (Vera 69881, then 69890). It names
what was judged, never which layer decided — the layer is already inside the refusal as decidedBy:

scope	meaning	grantBrokerRefusal
seat	the seat's environment was resolved and judged	null = checked, not refused
not_installed	the seat resolved to a governing owner, but that owner holds no installation of this identity + instance, so the projection carries no row for it	null = nothing was delivered, so nothing was judged
unbound	the seat could not be resolved to a governing installation — no machine binding, or no identity to bind	null = not judged
not_evaluated	the grant names a pod, not a seat: the refusal is a property of each seat that redeems it	null = there is no single verdict

Two holds, both about the same failure mode — a null that means two things. At f072aa73 the scope
was the constant 'server' for a pod-target grant ("checked, not refused" on the one surface the
granter looks at, while /assigned withholds the broker per seat). At aa36a497 a bound seat whose
owner holds no row for it returned seat + null, which reads as "judged, the broker reaches it";
in fact the daemon is handed nothing for that seat. A field whose value cannot vary carries no
information about coverage, and the fourth value is what makes "not delivered" sayable.

Why it is not a one-file change

The read cannot resolve a seat's environment. grep -arn AgentInstallation backend/routes/grants.ts backend/services/roomGrantService.ts returns nothing, and the obvious
shortcut is a trap: RoomGrant.installationId is the GitHub App connection's installation id
(grants.ts:159-160, written by roomGrantService.ts:263), not an AgentInstallation id — so the
grant cannot even name the seat's installation from its own row.

The projection that can answer this lived inline inside the /assigned handler
(agentBinding.ts:417-440). Writing a second resolver in grants.ts is precisely the "second
definition of the predicate" the TASK-063 ruling forbids, so the first commit extracts it:

new	backend/services/seatEnvironmentProjection.ts — the placeholder-only env/header allow-list, projectEnvironment, and projectSeatEnvironments({ installedBy })
agentBinding.ts	calls the extracted function; the inline map, the AgentInstallation require and the projection helpers are gone
grants.ts	resolves a verdict for the grants it is already projecting, via the same function

The extraction is behaviour-preserving: no ordering is imposed (first declaration still wins for a
duplicated identity), the daemon list still returns early when the owner has no active installations,
and the placeholder allow-list is moved, not rewritten.

One thing the move fixes for free: the daemon list built its identity keys with a raw NUL byte
inside a template literal while reading them back with the \0 escape. Same string at runtime, but it
made agentBinding.ts a binary file — grep said "Binary file matches" and sed rendered the
separator as a space. The extracted module uses the escape form and the key has one definition
(seatEnvironmentKey), which both sides of every lookup now call. That is visible in the mutation
table below: the separator mutation used to break seven tests across two files, because the two sides
could drift; it now breaks exactly the key's own assertion, because they cannot.

Scope: one resolution rule, no ordering guess

/assigned builds its work list from the machine owner's active installations. The read resolves
the same way — the seat's botMetadata.machineId → Machine.ownerUserId → that owner's projection —
which is what makes the two surfaces agree by construction rather than by coincidence when two
users have installed the same agent identity with different declarations. The route test proves it in
both directions by re-homing the seat's machine between two owners whose declarations disagree.

The identity-wide fallback is gone, not relabelled. For an unbound seat it returned whichever
installation Mongo happened to order first — a guess presented as a verdict, on a surface whose job
is to say whether a security control is in force. An unbound seat now reports unbound and its
refusal is null because nothing was judged. Three cases are deliberately kept distinct:

• bound, owner has an installation of this seat → judged; seat.
• bound, owner has no such installation → not_installed: the scope resolved (so this is not
  unbound — a daemon is polling that machine), but the projection holds no row for the seat, so
  there is no environment to judge and the broker reaches nobody. This is the arm Vera 69890 added,
  and the test that asserted seat here was inverted deliberately with a comment saying so.
  Both shapes of it are covered: an owner with no installations at all, and an owner whose active
  installations are all for other identities — what makes the arm true is that THIS seat has no
  row, not that the owner has none.
• unbound → unbound, and nothing is consulted.

Tests

Backend, whole suite on this head: 410 of 412 suites passed, 3676 tests passed, 22 failed across 2
suites — and both failing suites are the same environment failure, named rather than waved at:
mongodb-memory-server → Instance failed to start within 10000ms, which takes down a whole suite at
setup. Re-run in isolation with jest --onlyFailures on this head:
leakMatrix.agentRuntime.test.js PASS, agentBinding.phase2.test.js PASS. Neither is touched
by this PR (the changed files are grants.ts, agentBinding.ts, the extracted service and the two
test files); the failure mode is instance startup under a busy box, not an assertion. lint:ts 0
errors (1207 pre-existing warnings). The four suites this change affects, run on their own: 74
passed, 0 failed.

• New __tests__/unit/services/seatEnvironmentProjection.test.js (5) — the composite key, owner
  scope, first-declaration-wins, that a scoped call cannot leak another owner's seat, the
  instanceId normalisation (the schema lowercases agentName but not instanceId, so a raw
  template string would miss a seat stored as Quill), and the placeholder-only env allow-list.
• __tests__/unit/routes/grants.read.test.js (9 new) — a pi seat reads as refused with the layer
  named; a confining declaration and the 29-of-30 plain shape read as no refusal; mode: 'none'
  reads as refused; the machine-owner scope, in both directions; an unbound seat reads unbound
  with a bound control at an identical fixture, so the assertion is about the binding rather than
  about a missing installation; a bound seat with no installation under its owner reads
  not_installed with an installed control at an identical fixture, plus the owner-installed-for-
  other-seats shape of the same arm; the pod list carries the same refusal; a pod-addressed grant
  reads not_evaluated with a seat-grant control.
• The read's field list is asserted exactly by the pre-existing tests, so
  grantBrokerRefusal/grantBrokerRefusalScope are pinned there rather than added silently.

Eleven independent mutations, each reddening its own tests (serialized; control 74/74 green):

mutation	result
the key's NUL separator becomes a space	1 red (the key's own test — both sides call the one helper now)
identity parts stop being lowercased	2 red (the key test and the Quill lookup)
the read ignores the computed refusal	5 red
the scope is hardcoded back to a constant	2 red (unbound + pod target)
a pod target reports the seat scope	1 red (the pod test alone)
the resolution drops the owner scope (unscoped scan)	2 red (the scope test and the owner-has-not-installed case)
an unbound seat proceeds to be judged	1 red (the ordering-guess test alone)
a resolved-but-absent entry reports unbound	1 red before this arm existed (the owner-has-not-installed test alone)
not_installed relabelled seat (the pre-69890 reading)	2 red (both new arm tests)
not_installed relabelled unbound (the other wrong value)	2 red (both new arm tests)
the entry ternary inverted — a delivered seat reported not_installed	9 red (every judged-seat assertion)

Honest limit

A refusal made by the DAEMON is still invisible here. The heartbeat keeps only four fields after
normalizeAgentStates and Machine.ts declares no strict option, so Mongoose drops undeclared
paths and the server never learns that a daemon refused. The three scope values are therefore a
statement about the server's verdict only — none of them means "the broker reached nobody", and a
daemon that refuses after deriving its own environment is reported by none of the four values. A
seat whose declaration the server cannot judge is decided at the daemon, exactly the boundary #1765
documented.

Still open on TASK-063, deliberately not in this PR: the generic derive-time refusal in the cli's
environmentFor (needs a cli slot, behind the 0.1.51→0.1.56 ladder).

Merge order

Backend-only, no version bump, and it does not touch any cli file — so it does not queue behind the
cli ladder and no rung of it orders this. Cut from 373ac260 (#1765) and rebased onto d5afd20d
(#1753); no open PR touches any of the five files it changes.

Not in this PR: the server-side case hardening

Vera's route out of the case-insensitivity class — mount the grants router with caseSensitive: true
so an uppercased broker path 404s for every adapter, present and future — is deliberately not
here, and Vera has agreed that recording it on TASK-063 with a trigger is the right place. The daemon
refusal already covers every spelling for the only confinementless adapter, so what that change buys
is a third enforcement point against an adapter that does not exist yet; that is a change to an
existing route's matching contract and belongs in its own PR, not appended to one under gate.