feat(hybridagent): add TargetOUs to static config + deploy script

AdScannerService reads RuntimeConfig.TargetOUs (multi-OU surface) but the field was missing from ScanConfiguration, so SeedFromStatic never projected it. In static-only mode (HybridAgent) the producer could only scan the single LdapSearchBase, losing parity with the on-prem Worker's portal-edited TargetOUs list.

- ScanConfiguration.TargetOUs added (mirrors RuntimeConfig.TargetOUs)
- SeedFromStatic projects it through
- Divergence-warning helper compares it (no-op in static mode but useful when same Core lib is hosted with a DB)
- HybridAgent appsettings.json placeholder + doc comment
- Deploy-HybridAgent.ps1 -TargetOUs param + import-list entry

Tests: 86 Core + 15 Functions + 8 HybridAgent pass; 86 on-prem Core unchanged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: robgrame

Deploy-HybridAgent.ps1

@@ -122,6 +122,9 @@ param(
     [string]$ImportFromWorkerAppSettings,
     [string]$LdapServer,
     [string]$LdapSearchBase,
+    # Optional newline- or comma-separated list of OU DNs to scan. Maps to ScanSettings:TargetOUs.
+    # When empty, the producer scans LdapSearchBase as a single root.
+    [string]$TargetOUs,
     [int]$LdapPort,
     [Nullable[bool]]$LdapUseSsl,
     [string]$CronSchedule,
@@ -342,7 +345,7 @@ try {
         # ScanSettings: pull the AD-relevant fields only — Graph/Entra fields are intentionally
         # skipped because Entra scanning lives on the Azure Functions side of the deployment.
         $adFields = @(
-            'CronSchedule','LdapServer','LdapSearchBase','LdapPort','LdapUseSsl',
+            'CronSchedule','LdapServer','LdapSearchBase','TargetOUs','LdapPort','LdapUseSsl',
             'IncludeRecoveryKeyValue','MaxRetryAttempts','BaseRetryDelaySeconds',
             'CsvOutputPath','KeyValueExportPath','RetirementGraceDays'
         )
@@ -382,6 +385,7 @@ try {
     if ($PSBoundParameters.ContainsKey('CronSchedule'))     { $scanSettings['CronSchedule']    = $CronSchedule }
     if ($PSBoundParameters.ContainsKey('LdapServer'))       { $scanSettings['LdapServer']      = $LdapServer }
     if ($PSBoundParameters.ContainsKey('LdapSearchBase'))   { $scanSettings['LdapSearchBase']  = $LdapSearchBase }
+    if ($PSBoundParameters.ContainsKey('TargetOUs'))        { $scanSettings['TargetOUs']       = $TargetOUs }
     if ($PSBoundParameters.ContainsKey('LdapPort'))         { $scanSettings['LdapPort']        = $LdapPort }
     if ($PSBoundParameters.ContainsKey('LdapUseSsl') -and $null -ne $LdapUseSsl) {
         $scanSettings['LdapUseSsl'] = [bool]$LdapUseSsl

src/BitLockerKeyMonitor.Core/Models/ScanConfiguration.cs

@@ -16,6 +16,15 @@ public class ScanConfiguration
     /// <summary>LDAP search base DN</summary>
     public string LdapSearchBase { get; set; } = string.Empty;
 
+    /// <summary>
+    /// Comma/newline-separated list of OUs to scan. When empty, the scanner falls back to the
+    /// single <see cref="LdapSearchBase"/>. Mirrors <c>RuntimeConfig.TargetOUs</c> so the
+    /// HybridAgent (which reads config straight from appsettings.json in static-only mode)
+    /// can target the same multi-OU surface as the on-prem Worker's portal-edited DB row.
+    /// Example: <c>"OU=Workstations,DC=contoso,DC=com\nOU=Laptops,DC=contoso,DC=com"</c>.
+    /// </summary>
+    public string TargetOUs { get; set; } = string.Empty;
+
     /// <summary>LDAP port (389 or 636 for SSL)</summary>
     public int LdapPort { get; set; } = 636;
 

src/BitLockerKeyMonitor.Core/Services/ConfigurationProvider.cs

@@ -274,6 +274,8 @@ private void WarnIfRuntimeConfigDivergesFromAppsettings(RuntimeConfig dbConfig)
             divergences.Add($"LdapUseSsl: DB={dbConfig.LdapUseSsl} appsettings={_staticConfig.LdapUseSsl}");
         if (!string.Equals(dbConfig.LdapSearchBase ?? string.Empty, _staticConfig.LdapSearchBase ?? string.Empty, StringComparison.OrdinalIgnoreCase))
             divergences.Add($"LdapSearchBase: DB=\"{dbConfig.LdapSearchBase}\" appsettings=\"{_staticConfig.LdapSearchBase}\"");
+        if (!string.Equals(dbConfig.TargetOUs ?? string.Empty, _staticConfig.TargetOUs ?? string.Empty, StringComparison.OrdinalIgnoreCase))
+            divergences.Add($"TargetOUs: DB=\"{dbConfig.TargetOUs}\" appsettings=\"{_staticConfig.TargetOUs}\"");
 
         if (!string.Equals(dbConfig.CsvOutputPath ?? string.Empty, _staticConfig.CsvOutputPath ?? string.Empty, StringComparison.OrdinalIgnoreCase))
             divergences.Add($"CsvOutputPath: DB=\"{dbConfig.CsvOutputPath}\" appsettings=\"{_staticConfig.CsvOutputPath}\"");
@@ -326,6 +328,7 @@ private void EnsureNotStaticOnly(string operation)
         LdapPort = _staticConfig.LdapPort,
         LdapUseSsl = _staticConfig.LdapUseSsl,
         LdapSearchBase = _staticConfig.LdapSearchBase,
+        TargetOUs = _staticConfig.TargetOUs,
         CsvOutputPath = _staticConfig.CsvOutputPath,
         IncludeRecoveryKeyValue = _staticConfig.IncludeRecoveryKeyValue,
         KeyValueExportPath = _staticConfig.KeyValueExportPath,

src/BitLockerKeyMonitor.HybridAgent/appsettings.json

@@ -37,6 +37,8 @@
     "CronSchedule": "0 0 2 * * ?",
     "LdapServer": "",
     "LdapSearchBase": "",
+    "//TargetOUs": "Optional multi-OU list (newline-separated DNs). When empty, the scanner falls back to LdapSearchBase as a single root. Mirrors the on-prem Worker portal 'Target OUs' field.",
+    "TargetOUs": "",
     "LdapPort": 636,
     "LdapUseSsl": true,
     "IncludeRecoveryKeyValue": true,