feat(ql3): add read-only cluster context readiness

test/back/ql3ClusterImageReleaseAudit.test.cjs

@@ -29,6 +29,7 @@ test('accepts the reviewed native CI and digest release contracts', () => {
       clusterAdminProductFacade: true,
       clusterAdminOperatorContext: true,
       clusterAdminContextPreflight: true,
+      clusterAdminContextReadiness: true,
       ociAttestations: true,
       osVulnerabilityScan: {
         scanner: 'trivy@0.70.0',
@@ -145,6 +146,24 @@ test('rejects a Cluster Admin live gate that omits offline context preflight', (
   );
 });
 
+test('rejects a Cluster Admin live gate that omits read-only context readiness', () => {
+  const contract = fs.readFileSync(
+    path.join(root, 'scripts/ql3-cluster-admin-product-live-contract.cjs'),
+    'utf8',
+  );
+  assert.throws(
+    () =>
+      auditClusterImageCiWorkflow(
+        ciSource,
+        contract.replace(
+          'contextPreflight: true,\n      contextReadiness: true',
+          'contextPreflight: true,\n      contextReadiness: false',
+        ),
+      ),
+    /read-only readiness/,
+  );
+});
+
 test('rejects removal of the native cluster-admin image gate', () => {
   const mutated = ciSource.replace(
     'image_arch: arm64\n            image: admin',

test/back/ql3PackageBoundaryAudit.test.cjs

@@ -340,10 +340,10 @@ test('current QL3 workspace has exactly eighteen reviewed package boundaries', (
       rootSourceFileRoles: clusterAdmin.rootSourceFileRoles,
     },
     {
-      sourceFiles: 97,
+      sourceFiles: 99,
       rootSourceFiles: 1,
       rootSourceLines: 61,
-      nestedSourceFiles: 96,
+      nestedSourceFiles: 98,
       rootSourceFileRoles: {
         'modelInvocationMigrationCli.ts': 'binary_entry',
       },