When tenant policy exists and enabled, allow_zone_ids REPLACES the candidate floor list entirely. Phase 3 simplified. Bump v2.0.20