feat(ql3): persist cluster secret transition receipts

packages/ql3-cluster-admin/src/plugin-package/recovery/pluginPackageRecovery.ts

@@ -40,6 +40,7 @@ import {
   PostgresPluginPackageAutomationPublicationRepository,
   PostgresPluginPackageMaterializedRevisionRepository,
   PostgresPluginPackageSecretBindingRepository,
+  PostgresPluginPackageSecretBindingActivationPrerequisite,
   PostgresPluginPackagePublisherProvenanceRepository,
   PostgresPluginPackageTaskReconciliationRepository,
   PostgresProjectToolDefinitionSnapshotRepository,
@@ -318,6 +319,10 @@ export async function recoverClusterPluginPackages(
       repository,
       stageProvider: stageAuthority,
       publisher,
+      activationPrerequisite:
+        new PostgresPluginPackageSecretBindingActivationPrerequisite(
+          database.pool,
+        ),
       now: options.now,
     }).recover({
       ...(options.pageSize === undefined ? {} : { pageSize: options.pageSize }),

packages/ql3-cluster-admin/test/bootstrap.test.cjs

@@ -171,6 +171,7 @@ function database(serverVersionNum = '160014') {
                 'commit_plugin_package_task_reconciliation',
                 'commit_plugin_package_quarantine',
                 'enforce_plugin_package_secret_binding_target',
+                'enforce_plugin_package_secret_binding_transition_receipt_target',
                 'enforce_plugin_package_secret_materialization',
                 'enforce_plugin_package_stage_provenance',
                 'lock_active_plugin_package_project',

packages/ql3-cluster-admin/test/pluginPackageRecovery.test.cjs

@@ -35,6 +35,7 @@ function executorPrivileges() {
     'plugin_package_automation_publications',
     'plugin_package_automation_publication_heads',
     'plugin_package_secret_bindings',
+    'plugin_package_secret_binding_transition_receipts',
     'project_tool_definition_snapshots',
     'project_tool_definition_snapshot_sources',
     'plugin_package_publisher_provenance',
@@ -204,6 +205,7 @@ function database(serverVersionNum = '160014') {
               functionName,
               executeAllowed: ![
                 'enforce_plugin_package_secret_binding_target',
+                'enforce_plugin_package_secret_binding_transition_receipt_target',
                 'enforce_plugin_package_secret_materialization',
                 'enforce_plugin_package_stage_provenance',
                 'plugin_package_automation_start_allowed',
@@ -300,6 +302,7 @@ test('proves an empty executor queue and closes PostgreSQL before returning', as
     retry: 0,
     manualRequired: 0,
     superseded: 0,
+    deferred: 0,
     remaining: false,
     safeToAdmit: true,
   });