fireFromId, fireFromAlertId, fireFromActiveId and fireFromHash now use the
async collection APIs and async publish handlers (so try/catch catches
rejections). falsePositivesMyloc/industriesMyloc/comments.forReference are
cursor-only and needed no change. Verified over raw DDP against the seeded
dev Mongo 7; REST smoke stays byte-identical (12/12).
Empirically verified: 2.4 and 2.5 green against mongo:3.2 (npm-mongo 3.9.1);
2.6 bumps npm-mongo to 4.3.1 which refuses MongoDB < 3.6
(MongoCompatibilityError, wire version 4). Branch lands on Meteor 2.5.