feat(ql3): enforce staged secret binding persistence

packages/ql3-local-sqlite/test/pluginPackageWorkflowAdmissionRepository.test.cjs

@@ -156,7 +156,7 @@ test('atomically admits one generation-bound Workflow Run and exactly replays it
     },
     { runs: 1, steps: 2, events: 3, mutations: 2, admissions: 1 },
   );
-  assert.equal((await auditLocalSqliteReadiness(client)).contractVersion, 47);
+  assert.equal((await auditLocalSqliteReadiness(client)).contractVersion, 48);
 });
 
 test('runs an optional authorization guard inside new and replay transactions', async (t) => {
@@ -288,7 +288,7 @@ test('exactly replays immutable admission after the Workflow StepRun advances',
     },
     { status: 'running', version: 5, eventSequence: 5 },
   );
-  assert.equal((await auditLocalSqliteReadiness(client)).contractVersion, 47);
+  assert.equal((await auditLocalSqliteReadiness(client)).contractVersion, 48);
 });
 
 test('fails closed before writing when the exact installation is not active', async (t) => {