feat(ql3): add offline cluster context preflight

test/back/ql3ClusterImageReleaseAudit.test.cjs

@@ -28,6 +28,7 @@ test('accepts the reviewed native CI and digest release contracts', () => {
       runtimeInventory: true,
       clusterAdminProductFacade: true,
       clusterAdminOperatorContext: true,
+      clusterAdminContextPreflight: true,
       ociAttestations: true,
       osVulnerabilityScan: {
         scanner: 'trivy@0.70.0',
@@ -126,6 +127,24 @@ test('rejects a Cluster Admin live gate that omits operator context injection',
   );
 });
 
+test('rejects a Cluster Admin live gate that omits offline context preflight', () => {
+  const contract = fs.readFileSync(
+    path.join(root, 'scripts/ql3-cluster-admin-product-live-contract.cjs'),
+    'utf8',
+  );
+  assert.throws(
+    () =>
+      auditClusterImageCiWorkflow(
+        ciSource,
+        contract.replace(
+          'operatorContext: true,\n      contextPreflight: true',
+          'operatorContext: true,\n      contextPreflight: false',
+        ),
+      ),
+    /offline preflight/,
+  );
+});
+
 test('rejects removal of the native cluster-admin image gate', () => {
   const mutated = ciSource.replace(
     'image_arch: arm64\n            image: admin',