fix(ci): wait for live service readiness

test/back/ql3PluginPackageRecoveryE2ELiveContract.test.cjs

@@ -72,6 +72,16 @@ test('report migration evidence follows the complete PostgreSQL stream', () => {
   );
 });
 
+test('waits for PostgreSQL Service connectivity before migration', () => {
+  const readyProbe = live.indexOf('waitForPostgresService();');
+  const migration = live.indexOf(
+    "apply(migrationJob(), 'create reviewed migration Job')",
+  );
+  assert.ok(readyProbe > 0);
+  assert.ok(migration > readyProbe);
+  assert.match(live, /'pg_isready',[\s\S]*'--host',[\s\S]*POSTGRES_NAME/);
+});
+
 test('fixture locks are bound to durable version-three approval dispatches', () => {
   const value = createFixture({
     registry: 'registry.fixture.test',

test/back/ql3ProviderCredentialTestKubernetesLiveContract.test.cjs

@@ -14,6 +14,7 @@ const {
   executorJob,
   providerObservationKey,
   providerServerSource,
+  retryProviderEvidence,
   terminalJobSnapshot,
 } = require('../../scripts/ql3-provider-credential-test-kubernetes-live-contract.cjs');
 const {
@@ -363,6 +364,29 @@ test('starts a fresh provider request baseline after a container restart', () =>
   assert.equal(providerObservationKey(pod), 'provider-uid:1');
 });
 
+test('retries only bounded transient provider evidence failures', async () => {
+  let attempts = 0;
+  const evidence = await retryProviderEvidence(
+    async () => {
+      attempts += 1;
+      if (attempts < 3) throw new Error('{"code":"ECONNREFUSED"}');
+      return { requestCount: 1 };
+    },
+    async () => {},
+  );
+  assert.deepEqual(evidence, { requestCount: 1 });
+  assert.equal(attempts, 3);
+  await assert.rejects(
+    retryProviderEvidence(
+      async () => {
+        throw new Error('invalid evidence schema');
+      },
+      async () => {},
+    ),
+    /invalid evidence schema/,
+  );
+});
+
 test('provider fixture logs only generation and authorization decision', () => {
   const source = providerServerSource();
   assert.match(source, /event:'provider_request',generation,allowed/);