fix(ql3): install alpha finalizer dependencies

test/back/ql3AlphaStageIndex.test.cjs

@@ -327,6 +327,34 @@ test('workflow audit rejects a partial or prematurely uploaded stage index', (t)
   );
 });
 
+test('workflow audit rejects a stage finalizer without installed dependencies', (t) => {
+  const fixtureRoot = fs.realpathSync(
+    fs.mkdtempSync(path.join(os.tmpdir(), 'ql3-alpha-stage-dependencies-')),
+  );
+  t.after(() => fs.rmSync(fixtureRoot, { recursive: true, force: true }));
+  fs.mkdirSync(path.join(fixtureRoot, '.github/workflows'), {
+    recursive: true,
+  });
+  const source = fs.readFileSync(
+    path.join(root, '.github/workflows/ql3-ci.yml'),
+    'utf8',
+  );
+  const marker = '\n  alpha-stage-index:\n';
+  const markerIndex = source.indexOf(marker);
+  const workflow = `${source.slice(0, markerIndex)}${source
+    .slice(markerIndex)
+    .replace('pnpm install --frozen-lockfile --ignore-scripts', 'true')}`;
+  fs.writeFileSync(
+    path.join(fixtureRoot, '.github/workflows/ql3-ci.yml'),
+    workflow,
+  );
+  const report = auditAlphaStageIndexWorkflow(fixtureRoot);
+  assert.equal(report.compatible, false);
+  assert.ok(
+    report.findings.includes('ALPHA_STAGE_INDEX_FINALIZER_CONTRACT_DRIFT'),
+  );
+});
+
 test('CLI grammar keeps cross-index audit explicit', () => {
   assert.deepEqual(
     parseArguments([

test/back/ql3ClusterAlphaMilestone.test.cjs

@@ -216,3 +216,27 @@ test('workflow audit rejects missing final offline audit', (t) => {
     report.findings.includes('CLUSTER_MILESTONE_FINALIZER_CONTRACT_DRIFT'),
   );
 });
+
+test('workflow audit rejects a finalizer without installed dependencies', (t) => {
+  const fixtureRoot = fs.mkdtempSync(
+    path.join(os.tmpdir(), 'ql3-cluster-alpha-dependencies-'),
+  );
+  t.after(() => fs.rmSync(fixtureRoot, { recursive: true, force: true }));
+  const workflowDirectory = path.join(fixtureRoot, '.github/workflows');
+  fs.mkdirSync(workflowDirectory, { recursive: true });
+  const source = fs.readFileSync(
+    path.join(root, '.github/workflows/ql3-ci.yml'),
+    'utf8',
+  );
+  const marker = '\n  cluster-alpha-milestone:\n';
+  const markerIndex = source.indexOf(marker);
+  const workflow = `${source.slice(0, markerIndex)}${source
+    .slice(markerIndex)
+    .replace('pnpm install --frozen-lockfile --ignore-scripts', 'true')}`;
+  fs.writeFileSync(path.join(workflowDirectory, 'ql3-ci.yml'), workflow);
+  const report = auditClusterAlphaMilestoneWorkflow(fixtureRoot);
+  assert.equal(report.compatible, false);
+  assert.ok(
+    report.findings.includes('CLUSTER_MILESTONE_FINALIZER_CONTRACT_DRIFT'),
+  );
+});

test/back/ql3LocalAlphaMilestone.test.cjs

@@ -325,6 +325,35 @@ test('workflow audit rejects a partial milestone finalizer', (t) => {
   );
 });
 
+test('workflow audit rejects a finalizer without installed dependencies', (t) => {
+  const fixtureRoot = fs.realpathSync(
+    fs.mkdtempSync(path.join(os.tmpdir(), 'ql3-local-alpha-dependencies-')),
+  );
+  t.after(() => fs.rmSync(fixtureRoot, { recursive: true, force: true }));
+  fs.mkdirSync(path.join(fixtureRoot, '.github/workflows'), {
+    recursive: true,
+  });
+  const source = fs.readFileSync(
+    path.join(root, '.github/workflows/ql3-ci.yml'),
+    'utf8',
+  );
+  const marker = '\n  local-alpha-milestone:\n';
+  const markerIndex = source.indexOf(marker);
+  const workflow = `${source.slice(0, markerIndex)}${source
+    .slice(markerIndex)
+    .replace('pnpm install --frozen-lockfile --ignore-scripts', 'true')}`;
+  fs.writeFileSync(
+    path.join(fixtureRoot, '.github/workflows/ql3-ci.yml'),
+    workflow,
+  );
+  const report = auditLocalAlphaMilestoneWorkflow(fixtureRoot);
+  assert.equal(report.compatible, false);
+  assert.equal(
+    report.findings.includes('MILESTONE_FINALIZER_CONTRACT_DRIFT'),
+    true,
+  );
+});
+
 test('CLI grammar separates finalization, index audit and workflow audit', () => {
   assert.deepEqual(
     parseArguments(['--mode=audit', '--milestone=/tmp/ql3-alpha-milestone']),