Complete Discovery compilation and accept canonical PVE config keys

The first exact proof established all ten parent no-admission failures and registered-session controls, then stopped on a missing strings import. Complete that import and preserve ordinary hyphenated PVE dictionary keys while keeping duplicate/case-conflicting lock rejection.

Contract-Neutral: Preserves the guest safety protocol and its lock, identity, budget and dispatch requirements; completes compilation and accepts canonical hyphenated config keys.
Change-source: pulse-maintainer

internal/hostagent/guest_exec_guard.go

@@ -137,7 +137,7 @@ func guestExecConfigLock(config []byte) (string, bool) {
 			return "", false
 		}
 		for _, c := range key {
-			if !(c >= 'a' && c <= 'z' || c >= '0' && c <= '9' || c == '_') {
+			if !(c >= 'a' && c <= 'z' || c >= '0' && c <= '9' || c == '_' || c == '-') {
 				return "", false
 			}
 		}

internal/hostagent/guest_exec_guard_test.go

@@ -20,6 +20,7 @@ func TestGuestExecConfigLockDictionary(t *testing.T) {
 	}{
 		{"unlocked", "cores: 2\nname: home-assistant\n", "", true},
 		{"unicode name", "name: café\nmemory: 8192\n", "", true},
+		{"hyphenated PVE key", "name: vm\namd-sev: type=sev\n", "", true},
 		{"backup", "name: vm\nlock: backup\n", "backup", true},
 		{"other operation", "lock: migrate\n", "migrate", true},
 		{"comment", "# lock: backup\nname: vm\n", "", true},

internal/servicediscovery/deep_scanner.go

@@ -3,6 +3,7 @@ package servicediscovery
 import (
 	"context"
 	"fmt"
+	"strings"
 	"sync"
 	"time"