test(iwooos): 新增高價值配置集中 guard [skip ci]

scripts/security/security-mirror-progress-guard.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 
 import argparse
 import json
+import runpy
 from pathlib import Path
 from typing import Any
 
@@ -74,6 +75,8 @@ def collect_string_values(value: Any) -> list[str]:
 
 def validate(root: Path) -> None:
     security_dir = root / "docs" / "security"
+    config_control_guard = runpy.run_path(str(root / "scripts" / "security" / "iwooos-config-control-guard.py"))
+    config_control_guard["validate"](root)
 
     manifest = load_json(security_dir / "security-supply-chain-contract-manifest.snapshot.json")
     readiness = load_json(security_dir / "security-mirror-readiness.snapshot.json")
@@ -24961,7 +24964,7 @@ def validate(root: Path) -> None:
     assert_equal(
         "dry_run.latest_local_validation.result",
         local_validation["result"],
-        "SECURITY_MIRROR_PROGRESS_GUARD_OK; SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK",
+        "SECURITY_MIRROR_PROGRESS_GUARD_OK; SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK; IWOOOS_CONFIG_CONTROL_GUARD_OK",
     )
     assert_contains("dry_run.latest_local_validation.validated_steps", local_validation["validated_steps"], "CHECK_PROGRESS_GUARD")
     assert_contains(
@@ -24969,6 +24972,11 @@ def validate(root: Path) -> None:
         local_validation["validated_steps"],
         "CHECK_OWNER_RESPONSE_GUARD",
     )
+    assert_contains(
+        "dry_run.latest_local_validation.validated_steps",
+        local_validation["validated_steps"],
+        "CHECK_CONFIG_CONTROL_GUARD",
+    )
     assert_false("dry_run.latest_local_validation.runtime_actions_executed", local_validation["runtime_actions_executed"])
     assert_false("dry_run.latest_local_validation.payloads_ingested", local_validation["payloads_ingested"])
     assert_false("dry_run.latest_local_validation.production_ingestion_enabled", local_validation["production_ingestion_enabled"])