feat: per-target zone translation (#11)

[fastrevmd-lab]

What does this change do, and why?

Adds a per-target zone_map (master zone → slave zone) so a slave can use different zone names from the master. For example, the master's APP1/APP2/APP3/UNTRUST can become APPS/UNTRUST on a slave. Closes #11. Design spec: docs/superpowers/specs/2026-10-16-zone-translation-design.md.

• Translation: zone names are rewritten in policies, global policies, NAT rule-sets and address-book attach.
  • Policy contexts that collapse into one are concatenated in master order.
  • A duplicate policy name fails only that target.
  • APP1→APP2 becomes APPS→APPS.
• Zones are additive only:
  • security zones is never sent with replace="replace", even under --replace. This also stops --replace from wiping zone interface bindings.
  • A zone fed by several master zones is pushed as an empty zone: created if missing, otherwise untouched.
• Warnings go to stderr and never fail the run. They cover:
  • a zone being created with no interfaces
  • an existing zone with no interfaces
  • a zone that policies reference but the slave doesn't have
  • a zone_map key that isn't a zone on the master
• check translates the source the same way before comparing. A zone fed by several master zones is checked only for existence. Zones that exist only on the slave aren't drift, because push will never remove them.

Without a zone_map, the payload is byte-for-byte unchanged.

Does this touch the push/commit path?

Yes. It changes payload computation in srxsync/orchestrator.py and srxsync/diff.py, and push now makes one extra read-only fetch of the slave's security zones before loading.

• This PR touches the device push/commit path
• If checked above: no partial-commit regression, --dry-run still performs zero load/commit calls, no model output decides what gets pushed

Verified by hand: running push --dry-run against a fake transport with a zone_map returned ok, recorded zero load/commit_confirmed/confirm calls, and produced the expected "creating zone APPS" warning. Translation errors still go through the existing per-target except Exception handler, so --on-error still applies.

Not verified on hardware: the NAT from/to zone XML shape and a commit check of zones with no interfaces were confirmed on lab vsrx-ci. The XML shapes for global-policy from-zone/to-zone and address-book attach zone come from the Junos schema and haven't been exercised on a device yet. A lab dry run with a zone_map is recommended before relying on those paths.

Checklist

• ruff check . passes
• mypy srxsync passes
• pytest tests/unit passes (120 passed)
• Any new/changed test fixtures use synthetic data (no real device hostnames, serials, IPs, credentials, config snippets, or pre-shared keys/community strings)

🤖 Generated with Claude Code