Issue #226: permanently withhold Discovery Mode studies from historical sync

[KAVentures]

Privacy failure mode

PR #233's historical consent gate remains OFF, but connector/history_backfill.py excluded Discovery events by ID only while the study was still enabled. On deactivation, a user who had never connected an organization Gateway had no ordinary paused-sync skip range, so later enrollment + a separately confirmed backfill could include captured Discovery Mode evidence—contradicting the study's separately reviewed sharing promise.

Corrections

1. The historical eligibility filter now excludes the saved time window for the most recent legacy Discovery study even after deactivation, failing closed for malformed study cutoff metadata. It uses the earlier of scheduled end and actual deactivation.
2. When exiting a new Discovery study, the local API persists a durable event-ID skip range for the entire study even if no organization was enrolled; it seals just before and immediately after the state transition to avoid an in-flight capture gap. Future studies cannot erase these persisted exclusions.
3. Repeated deactivation no longer advances the original cutoff over unrelated later work.
4. Dedicated synthetic tests cover prior ordinary events, restricted study events, later ordinary events, an offline/no-Gateway study, malformed state and repeated deactivation.

No change to default OFF (OWG_ENABLE_HISTORY_BACKFILL), source connectors, Gateway APIs, explicit study-package sharing or forward cursor. Do not enable backfill from this PR alone—seeded Gateway privacy/migration/rollback acceptance (#236) and remaining rollout requirements still apply.

Run full Windows/macOS/Linux CI before merge; real signed Mac + Gateway acceptance is still required.

CI isolation fix (2026-10-16): Old main API tests on all 3 OSes unexpectedly received 401 after the new Discovery-mode test imported server.discovery_routes into the shared pytest process. That module transitively imports server.secure_app, registering its authorization middleware on server.main.app. The test now performs this route import and skip-range assertion in an isolated, temporary-data subprocess instead of polluting unrelated tests. Auth middleware is unchanged; no security guards are disabled. Commit 5e1d92c1 triggers full CI rerun. Do not merge until the entire latest matrix is green.

Conflict resolution after #235/#238/#237 merged (2026-10-16): Replayed the six #239 files onto fresh main (f0fd4308) with a force-with-lease update to 4e5972d6. In the three overlapping history/consent files, manually integrated the Discovery Mode exclusions and tests while retaining #237's SyncState.consume_if_matches atomic single-use consent, its expiry recheck, concurrent confirmation regression tests, and the corresponding documentation. The other three #239 files match their original PR blobs. GitHub now reports mergeable=true and the PR diff is restricted to the intended six files. The new Actions jobs must pass before merge; historical sync remains off by default.