fix(ci): preserve console capacity helper input

scripts/ql3-cluster-copilot-console-capacity-evidence.cjs

@@ -816,11 +816,14 @@ function seedVolume(image, volume, root, files) {
     [
       'run',
       '--rm',
+      '--interactive',
       '--read-only',
       '--network',
       'none',
       '--cap-drop',
       'ALL',
+      '--cap-add',
+      'CHOWN',
       '--security-opt',
       'no-new-privileges',
       '--user',
@@ -842,11 +845,14 @@ function rotateAssertion(image, volume, assertion) {
     [
       'run',
       '--rm',
+      '--interactive',
       '--read-only',
       '--network',
       'none',
       '--cap-drop',
       'ALL',
+      '--cap-add',
+      'CHOWN',
       '--security-opt',
       'no-new-privileges',
       '--user',

test/back/ql3ClusterCopilotConsoleCapacityEvidence.test.cjs

@@ -397,6 +397,8 @@ test('live source freezes native cgroup v2, isolation and assertion rotation mec
   ]) {
     assert.ok(scriptSource.includes(contract), `missing ${contract}`);
   }
+  assert.equal(scriptSource.match(/'--interactive'/g)?.length, 2);
+  assert.equal(scriptSource.match(/'--cap-add',\n      'CHOWN'/g)?.length, 2);
   assert.doesNotMatch(scriptSource, /run\.cancellation\.(?:rearm|stop|retry)/);
   assert.doesNotMatch(scriptSource, /--privileged|--network[= ]host/);
 });