mrhid6
e2f5f1fa8c
Two instances of the branch's recurring bug class remained in the agent path: a client-supplied ID accepted as data, then consumed by an unscoped query. - ListMonitorsForRunner filtered on `runner` alone, and `runner` is set by the client on monitor create/update. Org A could point a monitor at org B's server_id and org B's agent would fetch and execute the check. Now org-filtered, and `runner` is validated against the caller's org on create and update. - IngestResult resolved the monitor via the unfiltered getMonitorByID using a monitor_id from the agent's request body, letting org A's agent write state and incidents into org B's monitor and fire its channels. Now rejects on org mismatch and on a monitor not assigned to the reporting agent. The in-process scheduler passes an empty orgID as a documented sentinel for the cross-org server-run sweep. Install script still emits a single shared GRPC_HOST; the agent path resolves org from the server record, never from a hostname.