feat: add deployment zone overlays

tests/test_scanner.py

@@ -44,6 +44,14 @@ def test_scan_repo_emits_schema_valid_deterministic_snapshot(tmp_path: Path) ->
     assert nodes_by_label[("Lockfile", "package-lock.json")]["attributes"]["path"] == "package-lock.json"
     assert nodes_by_label[("ServiceConfig", "application.yaml")]["attributes"]["format"] == "yaml"
     assert nodes_by_label[("Server", "127.0.0.1")]["attributes"]["runtime_target_type"] == "compose-host"
+    dev_overlay = nodes_by_label[("Server", "127.0.0.1")]["attributes"]["deployment_overlay"]
+    assert dev_overlay["deployment_environment"] == "dev"
+    assert dev_overlay["deployment_scenario"] == "bernd-laptop"
+    assert dev_overlay["access_zone"] == "private-dev"
+    assert dev_overlay["policy_authority"] == "local-loopback-binding"
+    assert dev_overlay["exposure_class"] == "local-only"
+    assert dev_overlay["routing_authority"] == "docker-compose"
+    assert dev_overlay["route_evidence"]["port"] == 8080
     assert (
         nodes_by_label[("RuntimeService", "fixture-api.testing.svc.cluster.local")]["attributes"]["runtime_target_type"]
         == "kubernetes-service-dns"