RecordVMStatus is unscoped by host: any agent can write any VM's status

open   by a73x

Labels: backlog

[claude 2026-08-18] Carried in notes as #37. internal/server/store/store.go:1393 —
`RecordVMStatus(id, status, lastErr, ip string)` takes no host id, so the sync
service writes a status row from whichever agent sent the frame without proving the
VM is placed on that host. A misconfigured or hostile agent can overwrite the
status, last error, and reported address of a VM running on another host.
Fix: take the host id and scope the UPDATE by placement; the caller in
internal/server/syncsvc already knows which host the stream belongs to.