fix(ci): align kubernetes live evidence

test/back/ql3CloudNativePgLiveContract.test.cjs

@@ -132,9 +132,12 @@ test('provisions the fail-closed worker ingress identity and derives all role ev
   );
   assert.match(source, /const roleList = ROLE_NAMES\.map/);
   assert.match(source, /WHERE rolname IN \(\$\{roleList\}\)/);
-  assert.match(source, /assert\.deepEqual\(schema, \['53', '52'\]\)/);
-  assert.match(source, /migrationCount: 54/);
-  assert.match(source, /contractVersion: 53/);
+  assert.match(
+    source,
+    /assert\.deepEqual\(schema, \[String\(MIGRATION_COUNT\), String\(CONTRACT_VERSION\)\]\)/,
+  );
+  assert.match(source, /migrationCount: MIGRATION_COUNT/);
+  assert.match(source, /contractVersion: CONTRACT_VERSION/);
   assert.match(source, /createWorkerIngressTls\(tempDirectory\)/);
   for (const key of [
     'worker-credential-pepper',

test/back/ql3PluginPackageRecoveryE2ELiveContract.test.cjs

@@ -29,6 +29,12 @@ test('E2E live gate is opt-in and owns only one exact disposable Kind cluster',
   assert.match(live, /kind\(\['delete', 'cluster', '--name', clusterName\]/);
   assert.match(live, /QL3_KEEP_KIND_CLUSTER/);
   assert.match(live, /kindest\/node:v1\.32\.8@sha256:/);
+  assert.match(
+    live,
+    /image', 'tag', POSTGRES_IMAGE_REFERENCE, POSTGRES_RUNTIME_IMAGE/,
+  );
+  assert.match(live, /image: POSTGRES_RUNTIME_IMAGE/);
+  assert.match(live, /imagePullPolicy: 'Never'/);
   assert.match(
     live,
     /condition\.type === 'Failed' && condition\.status === 'True'/,

test/back/ql3ProviderCredentialTestKubernetesLiveAudit.test.cjs

@@ -2,6 +2,7 @@ const assert = require('node:assert/strict');
 const test = require('node:test');
 
 const {
+  AI_MIGRATION_COUNT,
   FIXTURE,
   LIMITATIONS,
   validateProviderCredentialTestKubernetesLiveReport,
@@ -36,7 +37,7 @@ function report() {
       managerRole: 'ql3_ai_credential_manager',
       testerRole: 'ql3_ai_credential_tester',
       migrationCount: 54,
-      aiMigrationCount: 15,
+      aiMigrationCount: AI_MIGRATION_COUNT,
       tlsVerified: true,
       primaryChangedDuringFailover: true,
     },

test/back/ql3ProviderCredentialTestKubernetesLiveContract.test.cjs

@@ -15,6 +15,19 @@ const {
   providerServerSource,
   terminalJobSnapshot,
 } = require('../../scripts/ql3-provider-credential-test-kubernetes-live-contract.cjs');
+const {
+  AI_MIGRATION_COUNT,
+} = require('../../scripts/ql3-provider-credential-test-kubernetes-live-audit.cjs');
+const {
+  postgresModelInvocationMigrationDefinition,
+} = require('../../packages/ql3-ai/dist/migration/modelInvocationMigration.js');
+
+test('binds live evidence to the complete reviewed AI migration stream', () => {
+  assert.equal(
+    AI_MIGRATION_COUNT,
+    postgresModelInvocationMigrationDefinition.migrations.length,
+  );
+});
 
 function template() {
   return {