[post-merge, multicast] test + doc cleaup

Includes:

- Move omdb multicast tests to dev-tools/omdb/tests/ using
  env!("CARGO_BIN_EXE_omdb") for reliable binary discovery
- Add object_put_upsert to nexus_test_utils, replace ad-hoc helpers
- Fix SOURCES semantics: show effective filter state ("-" = any member
  accepts any source whatsoever, else union of allowlists)
- Clarify docs: "Source allowlist, or '-' (any)"
- Fix authz test to use SiloUser for list (not PrivilegedUser) [cross zl/mcast-test-perf]

Author: zeeshanlakhani

dev-tools/omdb/src/bin/omdb/db.rs

@@ -131,6 +131,7 @@ use nexus_db_queries::db::pagination::paginated;
 use nexus_db_queries::db::queries::ALLOW_FULL_TABLE_SCAN_SQL;
 use nexus_db_queries::db::queries::region_allocation;
 use nexus_types::deployment::Blueprint;
+use nexus_types::deployment::BlueprintExpungedZoneAccessReason;
 use nexus_types::deployment::BlueprintZoneDisposition;
 use nexus_types::deployment::BlueprintZoneType;
 use nexus_types::deployment::DiskFilter;
@@ -1374,7 +1375,7 @@ impl DbArgs {
                         command: multicast::MulticastCommands::Groups(args),
                     }) => {
                         multicast::cmd_db_multicast_groups(
-                            &opctx, &datastore, &fetch_opts, &args,
+                            &datastore, &fetch_opts, &args,
                         )
                         .await
                     }
@@ -1393,7 +1394,7 @@ impl DbArgs {
                         command: multicast::MulticastCommands::Info(args),
                     }) => {
                         multicast::cmd_db_multicast_info(
-                            &opctx, &datastore, &fetch_opts, &args,
+                            &datastore, &fetch_opts, &args,
                         )
                         .await
                     }
@@ -1652,16 +1653,19 @@ async fn lookup_service_info(
     service_id: Uuid,
     blueprint: &Blueprint,
 ) -> anyhow::Result<Option<ServiceInfo>> {
-    let Some(zone_config) = blueprint
-        .all_omicron_zones(BlueprintZoneDisposition::any)
-        .find_map(|(_sled_id, zone_config)| {
-            if zone_config.id.into_untyped_uuid() == service_id {
-                Some(zone_config)
-            } else {
-                None
-            }
-        })
-    else {
+    // We don't know anything about `service_id`; it may be in-service or it may
+    // be expunged. Check all the zone states.
+    let mut all_zones = blueprint.all_in_service_and_expunged_zones(
+        BlueprintExpungedZoneAccessReason::Omdb,
+    );
+
+    let Some(zone_config) = all_zones.find_map(|(_sled_id, zone_config)| {
+        if zone_config.id.into_untyped_uuid() == service_id {
+            Some(zone_config)
+        } else {
+            None
+        }
+    }) else {
         return Ok(None);
     };