feat(ql3): enforce staged secret binding persistence

packages/ql3-cluster-postgres/test/pluginPackageSecretBindingRepository.test.cjs

@@ -129,6 +129,14 @@ test('publishes, exact-replays and finds one binding', async () => {
     value.queries.find(({ text }) => text.startsWith('INSERT')).text,
     /install\.state = 'active'/,
   );
+  assert.match(
+    value.queries.find(({ text }) => text.startsWith('INSERT')).text,
+    /install\.state = 'staged'/,
+  );
+  assert.match(
+    value.queries.find(({ text }) => text.startsWith('INSERT')).text,
+    /MAX\(history\.target_generation\)/,
+  );
 });
 
 test('rejects inactive targets and conflicting content', async () => {