fix(authz): allow registered AI discovery updates

server-tools/lake-lamp-authz/install-architecture-provisioner.test.js

@@ -9,6 +9,10 @@ const source = fs.readFileSync(
   path.join(__dirname, "install-architecture-provisioner.sh"),
   "utf8",
 );
+const architectureProvisionUnit = fs.readFileSync(
+  path.join(__dirname, "lake-lamp-architecture-provision.service"),
+  "utf8",
+);
 
 test("bootstrap installer preserves secrets and deploys the complete HoloLake capability set", () => {
   for (const file of [
@@ -47,3 +51,10 @@ test("provider migration writes only a private registry and never prints API key
   assert.doesNotMatch(source, /echo .*API_KEY/);
   assert.doesNotMatch(source, /printf .*API_KEY/);
 });
+
+test("architecture provision broker can update the registered AI discovery service", () => {
+  assert.match(
+    architectureProvisionUnit,
+    /^ReadWritePaths=.*\/opt\/guanghu\/ai-discovery(?:\s|$)/m,
+  );
+});