Security Operations Leaves

Purpose

Make the preserved weak-route leaves fully usable from the live shells instead of leaving them reachable only by typed URLs or overview-card luck.
Keep Mission Control, Security, and Ops > Operations as the owners of their respective operator workflows instead of reviving a separate legacy security-ops product.

Preserve stale bookmarks and old links by redirecting:
- /analyze/unknowns
- /analyze/unknowns/:unknownId
- /notify
Redirects must preserve query params and fragments so tenant, region, environment, return-to-context, and tab state survive the handoff.
Setup > Notifications remains the admin/configuration surface. Ops > Operations > Notifications remains the operator delivery and alert workflow surface.

Mission Control owns the cross-product alert and recent-activity pages and must surface them directly from the live sidebar.
Security owns the unknowns list and detail. Both read the Scanner unknowns registry (the list, stats and by-id reads under /api/v1/unknowns) with scanner:read; the registry is read-only, so the pages offer no identify, triage or resolve action.
Grey Queue withdrawn (2026-10-08, CCP-023). The Grey Queue dashboard (/security/unknowns/queue/grey) and the determinization review (/security/unknowns/:unknownId/determinization) read /api/v1/policy/unknowns, which no host maps, and offered triage actions without an owner. Both paths now resolve to the normal Page Not Found page; their /analyze/unknowns/... aliases are removed and those bookmarks follow the /analyze catch-all to /security. policy:read no longer admits a session to the Unknowns family. A durable review queue is deferred; no replacement page exists.
Ops > Operations owns notification delivery, channel health, and operator watchlist handoffs.
Internal links inside the unknowns subtree must stay inside /security/unknowns*, not dead /analyze/* routes.
Browser-level verification should use the mounted notifications page because the local frontend proxy reserves /notify; the alias itself is still required in app routing and verified at route-contract level.

Keep:
- mission alert and activity summaries as operator landing pages
- unknowns tracking (Scanner list and detail)
- notification delivery and watchlist handoff workflows
Why:
- these are already mounted product capabilities with useful operator actions
- the product issue was surfacing debt and stale route ownership, not lack of feature value

Added top-level alias coverage for stale /analyze/unknowns* and /notify entry points.
Retargeted shared navigation config from dead analyze and notify paths to the canonical security and operations owners.
Surfaced Alerts, Activity, Unknowns, and Notifications from the live sidebar shells.
Repaired unknowns grey-queue and determinization links so breadcrumbs and return paths stay inside canonical security routes (both pages were later withdrawn by CCP-023).
Added focused Angular and Playwright verification for the cutover.