Add disposable-network acceptance harness for active discovery

[sodejm]

Follow-up to [Proposal]: [E04.02] Add bounded active discovery and service identification from the acceptance audit of issues closed September 28–October 5, 2026.

Audited source: d090c6ad51e65ae739b247a55733390c38a5d5bd on main. This issue covers only the unmet criteria below; delivered behavior remains credited.

Unmet original acceptance criteria

Criterion 4: Test rate-limit enforcement, unreachable hosts, changed DNS, partial results and remediated exposure in disposable networks.

Missing disposable-network acceptance evidence: Offline simulated tests cover the required failure and remediation cases; no disposable-network harness/fixture or execution record establishes those cases at the network boundary.

Source evidence

• tests/test_active_discovery.py:130-279 — Offline tests cover unreachable hosts, changed DNS, partial budgets, rate limiting and remediation.
• cops/discovery/active_scanner.py:486-555 — Records remediation comparison results.

Acceptance criteria for this follow-up

• Provide a reproducible disposable-network harness with bounded destinations and negative/remediated controls for rate limits, unreachable hosts, DNS changes, and partial results.
• Record contained execution evidence for each case, separately from the existing simulated tests; document setup and cleanup.
• Run the focused acceptance checks and make check; update affected documentation, or record a concrete rationale if the change is solely acceptance-test coverage.

Validation and duplicate review

The clean audited Git checkout passed make check. That validates the existing suite, not the missing acceptance cases identified here. The audit used source inspection and offline/inert tests; it does not claim live assessment or deployment evidence.

The 66 open issues were reviewed before creation; no existing issue covers this exact remaining scope.