feat(ql3): harden cluster secret projection checks

packages/ql3-runtime-core/test/secretReference.test.cjs

@@ -9,6 +9,9 @@ const {
   createLocalSecretRef,
   parseLocalSecretRef,
 } = require('../dist/secret/localSecret');
+const {
+  secretProjectionFileName,
+} = require('@qinglong/runtime-core/secret-projection');
 
 test('keeps qlsecret:v1 profile-neutral and byte-compatible with local aliases', () => {
   const reference = { projectId: 'default', name: 'TOKEN', version: 2 };
@@ -20,12 +23,40 @@ test('keeps qlsecret:v1 profile-neutral and byte-compatible with local aliases',
   assert.equal(Object.isFrozen(parseSecretRef(value)), true);
 });
 
+test('maps only canonical SecretRefs to stable path-free projection names', () => {
+  const first = createSecretRef({
+    projectId: 'default',
+    name: 'TOKEN',
+    version: 2,
+  });
+  const second = createSecretRef({
+    projectId: 'default',
+    name: 'TOKEN',
+    version: 3,
+  });
+  assert.match(secretProjectionFileName(first), /^[0-9a-f]{64}$/);
+  assert.equal(
+    secretProjectionFileName(first),
+    secretProjectionFileName(first),
+  );
+  assert.notEqual(
+    secretProjectionFileName(first),
+    secretProjectionFileName(second),
+  );
+  assert.throws(
+    () => secretProjectionFileName('not-a-secret-ref'),
+    InvalidSecretReferenceError,
+  );
+});
+
 test('rejects non-canonical, cross-shape and unbounded Secret references', () => {
   for (const value of [
     'qlsecret:v1:',
     'qlsecret:v1:***',
     'local-secret:default:TOKEN',
-    `qlsecret:v1:${Buffer.from('{"name":"TOKEN","projectId":"default"}').toString('base64url')}`,
+    `qlsecret:v1:${Buffer.from(
+      '{"name":"TOKEN","projectId":"default"}',
+    ).toString('base64url')}`,
   ]) {
     assert.throws(() => parseSecretRef(value), InvalidSecretReferenceError);
   }