feat(ql3): add opt-in security administration job

test/back/ql3ClusterDeploymentAudit.test.cjs

@@ -34,7 +34,7 @@ test('accepts the exact locked non-root multi-replica cluster deployment', () =>
   );
   assert.equal(report.clusterCopilotMcpHost, 'external-host-stdio');
   assert.equal(report.promptOutputKeyRotation, 'caller-driven-staged-material');
-  assert.equal(report.clusterAdminImageReferences, 24);
+  assert.equal(report.clusterAdminImageReferences, 26);
   assert.deepEqual(report.workspacePackages, [
     '@qinglong/runtime-core',
     '@qinglong/cluster-postgres',
@@ -92,7 +92,7 @@ test('requires every Cluster Admin Kubernetes workload to override the image com
     ),
   });
   assert.equal(report.compatible, false);
-  assert.equal(report.clusterAdminImageReferences, 24);
+  assert.equal(report.clusterAdminImageReferences, 26);
   assert.equal(
     report.findings.some(
       ({ code }) => code === 'QL3_CLUSTER_ADMIN_IMAGE_COMMAND_IMPLICIT',

test/back/ql3DeploymentLockContract.test.cjs

@@ -919,11 +919,11 @@ test('CLI rejects symlinks, open arguments, output aliasing and policy ambiguity
 test('source-surface audit freezes every reviewed cluster and worker authority', () => {
   assert.deepEqual(auditDeploymentImageSurfaces(root), {
     schemaVersion: 1,
-    deploymentYamlFiles: 227,
+    deploymentYamlFiles: 241,
     imageOccurrences: {
       control: 2,
       'control-ai': 1,
-      admin: 26,
+      admin: 28,
       worker: 2,
     },
     admissionAuthorityCount: 2,

test/back/ql3PackageBoundaryAudit.test.cjs

@@ -340,10 +340,10 @@ test('current QL3 workspace has exactly eighteen reviewed package boundaries', (
       rootSourceFileRoles: clusterAdmin.rootSourceFileRoles,
     },
     {
-      sourceFiles: 132,
+      sourceFiles: 134,
       rootSourceFiles: 1,
       rootSourceLines: 61,
-      nestedSourceFiles: 131,
+      nestedSourceFiles: 133,
       rootSourceFileRoles: {
         'modelInvocationMigrationCli.ts': 'binary_entry',
       },

test/back/ql3SecurityAdministrationKubernetesAudit.test.cjs

@@ -0,0 +1,83 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const { test } = require('node:test');
+
+const {
+  auditSecurityAdministrationKubernetes,
+} = require('../../scripts/ql3-security-administration-kubernetes-audit.cjs');
+
+const ROOT = path.resolve(__dirname, '../..');
+
+function intercept(relativePath, transform) {
+  const target = path.join(ROOT, relativePath);
+  return (filePath, encoding) => {
+    const value = fs.readFileSync(filePath, encoding);
+    return path.resolve(filePath) === target ? transform(value) : value;
+  };
+}
+
+test('accepts the opt-in one-shot security administration deployment', () => {
+  const report = auditSecurityAdministrationKubernetes({ root: ROOT });
+
+  assert.equal(report.compatible, true, JSON.stringify(report.findings));
+  assert.equal(report.executionModel, 'opt-in-caller-driven-one-shot');
+  assert.equal(report.residentResourceOverhead, 'zero');
+  assert.equal(report.databaseConnectionsPerExecution, 1);
+});
+
+test('rejects Kubernetes API token authority in the administration Job', () => {
+  const report = auditSecurityAdministrationKubernetes({
+    root: ROOT,
+    readFile: intercept(
+      'deploy/kubernetes/ql3-cluster/operations/security-administration/base/job.yaml',
+      (value) =>
+        value.replace(
+          'automountServiceAccountToken: false',
+          'automountServiceAccountToken: true',
+        ),
+    ),
+  });
+
+  assert.equal(report.compatible, false);
+  assert.ok(
+    report.findings.some(
+      ({ code }) =>
+        code === 'QL3_SECURITY_ADMIN_KUBERNETES_API_AUTHORITY_INVALID',
+    ),
+  );
+});
+
+test('rejects a non-persistent credential delivery boundary', () => {
+  const report = auditSecurityAdministrationKubernetes({
+    root: ROOT,
+    readFile: intercept(
+      'deploy/kubernetes/ql3-cluster/operations/security-administration/credential-delivery/component/job-patch.yaml',
+      (value) => value.replace('persistentVolumeClaim:', 'emptyDir:'),
+    ),
+  });
+
+  assert.equal(report.compatible, false);
+  assert.ok(
+    report.findings.some(
+      ({ code }) => code === 'QL3_SECURITY_ADMIN_KUBERNETES_DELIVERY_INVALID',
+    ),
+  );
+});
+
+test('rejects accidental installation in the shared cluster aggregate', () => {
+  const report = auditSecurityAdministrationKubernetes({
+    root: ROOT,
+    readFile: intercept(
+      'deploy/kubernetes/ql3-cluster/operations/kustomization.yaml',
+      (value) => `${value}  - security-administration/base\n`,
+    ),
+  });
+
+  assert.equal(report.compatible, false);
+  assert.ok(
+    report.findings.some(
+      ({ code }) => code === 'QL3_SECURITY_ADMIN_KUBERNETES_OPT_IN_INVALID',
+    ),
+  );
+});

test/back/ql3VersionTransition.test.cjs

@@ -102,9 +102,9 @@ test('audits one source-derived QingLong 3 release identity', () => {
     legacyRootExcluded: true,
     workspacePackageCount: 18,
     containerRootCount: 4,
-    deploymentFileCount: 246,
-    deploymentImageReferences: 32,
-    deploymentVersionOccurrences: 36,
+    deploymentFileCount: 260,
+    deploymentImageReferences: 34,
+    deploymentVersionOccurrences: 38,
     compatible: true,
   });
 });
@@ -115,8 +115,8 @@ test('plans the exact governed version surface without touching legacy 2.x', ()
     sourceVersion: SOURCE_VERSION,
     targetVersion: TARGET_VERSION,
   });
-  assert.equal(plan.fileCount, 65);
-  assert.equal(plan.replacementCount, 83);
+  assert.equal(plan.fileCount, 66);
+  assert.equal(plan.replacementCount, 85);
   assert.equal(plan.legacyRootPackageVersion, LEGACY_VERSION);
   assert.equal(plan.legacyRootExcluded, true);
   assert.equal(