feat(ql3): add frozen-admission cutover probe

packages/ql3-local-owner-cli/test/cutoverTargetRun.test.cjs

@@ -104,7 +104,13 @@ function targetInspection(state, options = {}) {
       },
       Config: {
         Image: state.targetImage,
-        Cmd: ['--config', state.targetApplicationConfigPath],
+        Cmd: [
+          ...(options.normalApplicationCommand === true
+            ? []
+            : ['--cutover-probe']),
+          '--config',
+          state.targetApplicationConfigPath,
+        ],
       },
       HostConfig: {
         RestartPolicy: { Name: 'no' },
@@ -612,6 +618,27 @@ test('requires the target container to keep the Legacy source read-only', async
   assert.equal(request.evidence.reason, 'target_preflight_unproved');
 });
 
+test('requires cutover target-start to use frozen-admission probe mode', async (t) => {
+  const state = fixture(t);
+  const controller = harness(state, { normalApplicationCommand: true });
+  const result = await runLocalDeploymentDockerTarget(
+    command(state),
+    controller,
+  );
+  assert.equal(result.state, 'manual_required');
+  assert.equal(
+    controller.calls.filter((args) => args[1] === 'start').length,
+    0,
+  );
+  const request = JSON.parse(
+    fs.readFileSync(
+      path.join(state.journal, '0003-target-start-decision.json'),
+      'utf8',
+    ),
+  );
+  assert.equal(request.evidence.reason, 'target_preflight_unproved');
+});
+
 test('starts an offline Trial Kit image only when its local reference and content ID both match', async (t) => {
   const state = fixture(t);
   state.targetImageAuthority = 'local-image-id';