ALL-1989 PR #12706 follow-up: guarded predicate variant + auth verification + CI watch

Seph's 14:36 UTC security review on PR #12706 raised three non-blocking observations. He approved shipping a follow-up commit on the same PR (his 14:45 UTC reply: 'Ship as a follow-up commit on this PR'). Work: 1. EXPOSE deviceFilterPredicateToEsGuarded in domains/device/src/services/monitor/deviceFilterPredicateToEs.ts that returns [{ match_none: {} }] when input is empty (instead of fail-OPEN current behavior). Update the docstring on the existing deviceFilterPredicateToEsClauses to NOT bless fail-open — make it clear callers MUST layer a match_none guard if they use the raw variant. Update unit tests in deviceFilterPredicateToEs.test.ts to cover the new guarded variant. 2. VERIFY observation #2: preview path in monitorService.ts builds boolQuery.filter = clauses.filter directly. Read the preview resolver upstream to confirm input.workspaceId is auth-validated before reaching this code. If yes: post a one-line ack in the PR security review thread (or PR comment) noting the upstream auth check. If no: that becomes a real finding, escalate via Slack thread to Seph before merge. 3. ACK observation #3 in the PR thread (the (t as unknown as Record<string,unknown>).targetFilter cast in evaluator.ts) — no code change needed, just confirm we'll drop the cast on next Prisma regen. 4. Local checks per ~/shared-knowledge/POST-PUSH-PROTOCOL.md before push. 5. PUSH to branch wintermute/all-1989-device-filter-es-translation. 6. WATCH CI through terminal state (every gate reports green/red). Specifically: test-device-domain, DeepSource JS, DeepSource coverage, build, Apollo. Note: the 'reconcile missing path-excluded statuses' check is currently failing across the repo (MODULE_NOT_FOUND on .github/scripts/required-status-reconciler.mjs) — that is CI infra unrelated to our changes; not a blocker. 7. POST progress event with final terminal CI state. If green: ONE post in the existing PR thread (1782398490.871299 in #wintermute-seph C0B1AFH70K1) with the new commit SHA + green confirmation + ack of observation #2 result + ack of observation #3. If red: fix and re-push, repeat watch. DO NOT merge. Seph holds the merge button (MEMORY.md MERGE POLICY). Current HEAD: 67eab7dd (doc-only commit already pushed at 14:49 UTC, in flight). The guarded-variant commit will be on top of that. Linear: ALL-1989. PR: https://github.com/TextureHQ/mono/pull/12706. Slack thread root ts: 1782398490.871299 in C0B1AFH70K1.