feat(ql3): govern release version transitions

scripts/ql3-cluster-image-release-audit.cjs

@@ -282,6 +282,16 @@ function auditClusterImageCiWorkflow(
     /pnpm audit:image-release:ql3/,
     'image CI must audit the shared release workflow contract',
   );
+  requirePattern(
+    source,
+    /test\/back\/ql3VersionTransition\.test\.cjs/,
+    'supply-chain CI must run release version transition negative tests',
+  );
+  requirePattern(
+    source,
+    /pnpm audit:release-version:ql3/,
+    'supply-chain CI must audit the source-derived release version identity',
+  );
   requirePattern(
     source,
     /docker build[\s\S]*--file \$\{\{ matrix\.dockerfile \}\}[\s\S]*--target \$\{\{ matrix\.target \}\}/,
@@ -375,6 +385,7 @@ function auditClusterImageCiWorkflow(
     clusterAdminOperatorContext: true,
     clusterAdminContextPreflight: true,
     clusterAdminContextReadiness: true,
+    releaseVersionAudit: true,
     ociAttestations: true,
     osVulnerabilityScan: {
       scanner: 'trivy@0.70.0',