fix(ql3): admit external secret reconciliation review

scripts/ql3-local-alpha-reconciliation-decision-fixture.cjs

@@ -289,7 +289,14 @@ function completionReviewFixture(root, output) {
   const decisions = [];
   for (const fact of facts) {
     if (fact.decisionRequirement === 'informational') continue;
-    if (fact.decisionRequirement === 'blocked') {
+    const externallyRecoverableSecretConfig =
+      fact.decisionRequirement === 'blocked' &&
+      fact.domain === 'secret_and_config' &&
+      fact.reason === 'secret_custody_required';
+    if (
+      fact.decisionRequirement === 'blocked' &&
+      !externallyRecoverableSecretConfig
+    ) {
       fail('completion review fixture refuses blocked diagnostic facts');
     }
     const automationTable =

test/back/ql3LocalAlphaReconciliationDecisionFixture.test.cjs

@@ -298,7 +298,8 @@ function completionReviewState(t) {
               : 'QingLong3Secrets'
             : 'QingLong3Runs',
         rowCount: '1',
-        decisionRequirement: 'required',
+        decisionRequirement:
+          domain === 'secret_and_config' ? 'blocked' : 'required',
         reason:
           domain === 'run_history'
             ? 'historical_preservation_required'