feat: adopt security zones and explicit workload refs

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

tests/test_flex_auth_registry.py

@@ -31,4 +31,53 @@ def test_build_registry_from_inventory_seed(tmp_path):
     )
     assert bridge["attributes"]["actor_type"] == "agt"
     assert bridge["attributes"]["max_ttl_hours"] == 24
-    assert "agt-task-bridge" in bridge["attributes"]["allowed_principals"]
+    assert "agt-task-bridge" in bridge["attributes"]["allowed_principals"]
+    assert "trust_zone" not in bridge
+    assert bridge["attributes"]["security_zone"] == "unknown"
+    assert bridge["attributes"]["security_zone_admission"] == "unknown"
+    assert bridge["attributes"]["workload_id"] == "ops-bridge-tunnel"
+
+    human = next(
+        r
+        for r in registry["resource_manifests"][0]["resources"]
+        if r["id"] == "ssh-cert:actor/adm-example"
+    )
+    assert human["attributes"]["security_zone_admission"] == "not-applicable"
+
+
+def test_compiler_joins_explicit_workload_reference_to_resolved_zone(tmp_path):
+    zones = tmp_path / "zones.json"
+    zones.write_text(json.dumps({
+        "records": [{
+            "workload_id": "ops-bridge-tunnel",
+            "declared_zone": "z2-continuity",
+            "admission": "satisfied",
+            "admission_reason": "admission_floor_met",
+            "effective_zone": "z2-continuity",
+            "membership_revision": "sha256:zone-revision",
+        }]
+    }))
+    out = tmp_path / "registry.json"
+    subprocess.run(
+        [
+            sys.executable,
+            str(SCRIPT),
+            str(INVENTORY),
+            "--zone-resolutions",
+            str(zones),
+            "-o",
+            str(out),
+        ],
+        check=True,
+        cwd=ROOT,
+    )
+    registry = json.loads(out.read_text())
+    bridge = next(
+        r
+        for r in registry["resource_manifests"][0]["resources"]
+        if r["id"] == "ssh-cert:actor/agt-state-hub-bridge"
+    )
+    attrs = bridge["attributes"]
+    assert attrs["security_zone"] == "z2-continuity"
+    assert attrs["security_zone_admission"] == "satisfied"
+    assert attrs["security_zone_revision"] == "sha256:zone-revision"