feat: add deployment zone overlays

tests/test_deployment_zone_inventory.py

@@ -0,0 +1,47 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+import yaml
+
+
+def test_deployment_zone_inventory_covers_current_scenarios() -> None:
+    inventory = yaml.safe_load(
+        Path("fabric/discovery/snapshots/2026-05-24-deployment-zone-inventory.yaml").read_text(encoding="utf-8")
+    )
+
+    surfaces = inventory["surfaces"]
+    scenarios = {surface["deployment_scenario"] for surface in surfaces}
+    environments = {surface["deployment_environment"] for surface in surfaces}
+
+    assert {"bernd-laptop", "coulombcore", "railiance01"} <= scenarios
+    assert {"dev", "test", "prod"} <= environments
+
+    dev_routes = [
+        surface["route_evidence"]
+        for surface in surfaces
+        if surface["deployment_environment"] == "dev"
+    ]
+    assert {route["port"] for route in dev_routes} >= {3000, 8000, 8001, 8765, 8876}
+
+    test_routes = [
+        surface
+        for surface in surfaces
+        if surface["deployment_scenario"] == "coulombcore"
+    ]
+    assert all(surface["routing_authority"] == "ops-bridge" for surface in test_routes)
+    assert all(surface["policy_authority"] == "ops-bridge-ssh" for surface in test_routes)
+
+    prod_hosts = {
+        surface["route_evidence"]["hostname"]
+        for surface in surfaces
+        if surface["deployment_scenario"] == "railiance01"
+    }
+    assert {"gitea.coulomb.social", "vergabe-teilnahme.whywhynot.de", "auth.coulomb.social"} <= prod_hosts
+
+    ambiguity_ids = {item["id"] for item in inventory["ambiguities"]}
+    assert "railiance01-coulombcore-ip-conflict" in ambiguity_ids
+    assert {item["surface_id"] for item in inventory["missing_policy_authority"]} >= {
+        "prod.railiance01.gitea",
+        "prod.railiance01.vergabe-teilnahme",
+    }