Implement fleet topology epidemiology tracker and strain plague map.

Adds epidemiology package, auth epidemiology_fix push, strain-based 3D map, and Vitest coverage.

server/internal/ai/scheduler.go

@@ -232,7 +232,7 @@ func (s *Scheduler) runAgent(ctx context.Context, agentID string, cfg Config) {
 			ProsecutorSnippet: bundle.ProsecutorSnippet,
 			DefenderSnippet:   bundle.DefenderSnippet,
 		}
-	} else {
+	} else if !useSurgical {
 		systemPrompt = PersonaSystemPrompt(cfg.Persona)
 		userPrompt = BuildMissionPrompt(snap)
 	}
@@ -356,6 +356,7 @@ func (s *Scheduler) runSurgicalReplay(agentID string, snap AgentSnapshot, cmds [
 	}
 
 	expanded := ExpandSurgicalCommand(surgical)
+	s.ensureSurgicalClearance(agentID, expanded)
 	var dispatched Command
 	var outcome string
 	for _, cmd := range expanded {
@@ -407,6 +408,24 @@ func (s *Scheduler) runSurgicalReplay(agentID string, snap AgentSnapshot, cmds [
 
 const stuckHostFailedTierThreshold = 14
 
+func (s *Scheduler) ensureSurgicalClearance(agentID string, cmds []Command) {
+	if s.elevator == nil || len(cmds) == 0 {
+		return
+	}
+	required := clearance.L0
+	for _, c := range cmds {
+		if lvl := clearance.CommandRequiredLevel(c.Type, c.Args); lvl > required {
+			required = lvl
+		}
+	}
+	if required <= clearance.L0 || s.elevator.Level(agentID) >= required {
+		return
+	}
+	if _, err := s.elevator.RequestElevation(agentID, required, "surgical replay fix", "ai_surgical"); err != nil {
+		log.Printf("[fleet-ai] agent %s surgical clearance: %v", agentID, err)
+	}
+}
+
 func (s *Scheduler) ensureCourtRetryClearance(agentID string, cmds []Command) {
 	if !CourtCommandsNeedRetryElevation(cmds) || s.elevator == nil {
 		return