fix(ci): build Vault adapter workspace closure

.github/workflows/ql3-ci.yml

@@ -1261,9 +1261,10 @@ jobs:
             "$(sha256sum "${RUNNER_TEMP}/kubectl" | cut -d ' ' -f 1)"
           chmod 0755 "${RUNNER_TEMP}/kubectl"
       - name: Build the direct custody adapter
-        run: |
-          pnpm --filter @qinglong/runtime-core build
-          pnpm --filter @qinglong/cluster-control build
+        run: >-
+          pnpm -r --workspace-concurrency=1
+          --filter @qinglong/cluster-control...
+          run build
       - name: Verify the fail-closed adapter and evidence contracts
         run: |
           node --test \

test/back/ql3CiCleanCheckoutContract.test.cjs

@@ -114,6 +114,17 @@ test('bootstraps jobs that previously depended on local modules or artifacts', (
     'pnpm run build:packages:ql3',
     'pnpm test:cloudnativepg-live:ql3',
   ]);
+
+  const vaultKvLive = jobSource(
+    'cluster-vault-kv-worker-secret-live',
+    'cluster-plugin-package-kubernetes-live',
+  );
+  assertOrdered(vaultKvLive, [
+    'pnpm install --frozen-lockfile --ignore-scripts',
+    'pnpm -r --workspace-concurrency=1',
+    '--filter @qinglong/cluster-control...',
+    'node --test',
+  ]);
 });
 
 test('rebuilds the only native legacy binding used by resource evidence', () => {