fix(backup): align Host110 runtime manifest staging

scripts/reboot-recovery/tests/test_agent99_host110_backup_runtime_broker.py

@@ -50,6 +50,22 @@ def _sha256(path: Path) -> str:
     return hashlib.sha256(path.read_bytes()).hexdigest()
 
 
+def _powershell_string(source: str, variable: str) -> str:
+    match = re.search(rf'\${re.escape(variable)}\s*=\s*"([^"]+)"', source)
+    assert match is not None, variable
+    return match.group(1)
+
+
+def _powershell_array(source: str, variable: str) -> tuple[str, ...]:
+    match = re.search(
+        rf'\${re.escape(variable)}\s*=\s*@\((.*?)\n\)',
+        source,
+        re.DOTALL,
+    )
+    assert match is not None, variable
+    return tuple(re.findall(r'"([^"]+)"', match.group(1)))
+
+
 def test_windows99_broker_fetches_exact_gitea_revision_and_is_bounded() -> None:
     source = BROKER.read_text(encoding="utf-8")
 
@@ -75,6 +91,34 @@ def test_windows99_broker_fetches_exact_gitea_revision_and_is_bounded() -> None:
     assert 'Invoke-Agent99BoundedScp $sourcePackage.localPaths' in source
 
 
+def test_broker_scp_basenames_match_executor_source_stage_contract() -> None:
+    broker = BROKER.read_text(encoding="utf-8")
+    executor = EXECUTOR.read_text(encoding="utf-8")
+
+    runtime_paths = _powershell_array(broker, "RuntimeRelativePaths")
+    executor_path = _powershell_string(broker, "ExecutorRelativePath")
+    verifier_path = _powershell_string(broker, "VerifierRelativePath")
+    manifest_match = re.search(
+        r'\$manifestPath\s*=\s*Join-Path\s+\$sourceRoot\s+"([^"]+)"',
+        broker,
+    )
+    assert manifest_match is not None
+    manifest_name = manifest_match.group(1)
+
+    staged_basenames = tuple(
+        Path(path).name
+        for path in (*runtime_paths, executor_path, verifier_path, manifest_name)
+    )
+    assert len(staged_basenames) == 21
+    assert len(set(staged_basenames)) == 21
+    assert manifest_name == "manifest.json"
+    assert '$localPaths += $executorPath, $verifierPath, $ManifestPath' in broker
+    assert 'Invoke-Agent99BoundedScp $sourcePackage.localPaths $remoteStage' in broker
+    assert f'$SOURCE_STAGE/{manifest_name}' in executor
+    assert f'$SOURCE_STAGE/{Path(verifier_path).name}' in executor
+    assert Path(executor_path).name == "host110-backup-runtime-executor.sh"
+
+
 def test_windows99_broker_verify_is_independent_no_write_and_evidence_is_immutable() -> None:
     source = BROKER.read_text(encoding="utf-8")