fix(p0): secure agent revocation and R6 worker queue

agent_v0/server_v1/agent_registry.py

@@ -173,6 +173,9 @@ class AgentRegistry:
                     # Deja enrolle et actif -> conflit explicit
                     raise AgentAlreadyEnrolledError(dict(existing))
 
+                if existing["uninstall_reason"] == "admin_revoke":
+                    raise AgentRevokedError(dict(existing))
+
                 # Agent desinstalle : reactivation si autorise (defaut)
                 if not allow_reactivate:
                     raise AgentAlreadyEnrolledError(dict(existing))
@@ -273,13 +276,15 @@ class AgentRegistry:
         """Met a jour last_seen_at (appel depuis le stream / heartbeat).
 
         Silencieux si l'agent est inconnu (evite les erreurs sur vieux clients).
+        Ne reactive jamais un agent desinstalle/revoque.
         """
         if not machine_id:
             return
         now = _utc_now_iso()
         with _DB_LOCK, self._connect() as conn:
             conn.execute(
-                "UPDATE enrolled_agents SET last_seen_at = ? WHERE machine_id = ?",
+                "UPDATE enrolled_agents SET last_seen_at = ? "
+                "WHERE machine_id = ? AND status = 'active'",
                 (now, machine_id),
             )
             conn.commit()
@@ -294,3 +299,14 @@ class AgentAlreadyEnrolledError(Exception):
             f"machine_id={existing_row.get('machine_id')} deja enrole "
             f"(status={existing_row.get('status')})"
         )
+
+
+class AgentRevokedError(Exception):
+    """Levee si un administrateur a revoque ce machine_id."""
+
+    def __init__(self, existing_row: Dict[str, Any]):
+        self.existing = existing_row
+        super().__init__(
+            f"machine_id={existing_row.get('machine_id')} revoque "
+            f"(reason={existing_row.get('uninstall_reason')})"
+        )