fix(sre): align runtime verifier contracts

scripts/reboot-recovery/agent99-live-preflight.ps1

@@ -456,7 +456,7 @@ $commandQueue = $queues | Where-Object { $_.relativePath -eq "queue" } | Select-
 $decision = Get-AgentLivePreflightDecision `
   -AgentRootPresent ([bool](Test-Path $AgentRoot)) `
   -Manifest $manifest `
-  -ExpectedRuntimeFileCount 15 `
+  -ExpectedRuntimeFileCount 16 `
   -TaskFailureCount $taskFailures.Count `
   -RelayListenerCount $relayListeners.Count `
   -RequiredEvidenceStaleCount $requiredEvidenceStale.Count `

scripts/reboot-recovery/tests/test_agent99_live_preflight_decision.py

@@ -36,7 +36,7 @@ def _base_case() -> dict[str, Any]:
             "exists": True,
             "sourceRevision": "a" * 40,
             "runtimeMatched": True,
-            "fileCount": 15,
+            "fileCount": 16,
             "mismatchCount": 0,
             "parseError": "",
         },
@@ -81,7 +81,7 @@ $case = @'
 $parameters = @{{
   AgentRootPresent = [bool]$case.agentRootPresent
   Manifest = $case.manifest
-  ExpectedRuntimeFileCount = 15
+  ExpectedRuntimeFileCount = 16
   TaskFailureCount = [int]$case.taskFailureCount
   RelayListenerCount = [int]$case.relayListenerCount
   RequiredEvidenceStaleCount = [int]$case.requiredEvidenceStaleCount
@@ -125,6 +125,7 @@ def test_warning_receipt_is_visible_without_weakening_integrity_blockers() -> No
     assert '$blockingReasons += "sre_alert_relay_not_listening"' in decision
     assert "deploymentEligible = [bool]($blockingReasons.Count -eq 0)" in decision
     assert "preflightGreen = [bool]$decision.deploymentEligible" in source
+    assert "-ExpectedRuntimeFileCount 16" in source
     assert "warningReasons = $warningReasons" in source
     assert "selfHealthPerformanceIssues = @(" in source
     assert 'if ($safeHost -notmatch "^[A-Za-z0-9.:-]{1,128}$")' in source
@@ -263,6 +264,12 @@ def test_decision_behavior_when_powershell_is_available() -> None:
             ("runtime_manifest_identity_invalid",),
             (),
         ),
+        (
+            _with_overrides(manifest={"fileCount": 15}),
+            False,
+            ("runtime_manifest_identity_invalid",),
+            (),
+        ),
         (
             _with_overrides(relayListenerCount=0),
             False,

scripts/reboot-recovery/tests/test_agent99_remote_atomic_deploy_transport_contract.py

@@ -18,6 +18,7 @@ RECEIVER = (
     / "scripts/reboot-recovery/agent99-remote-atomic-deploy-receiver.ps1"
 )
 DEPLOYER = ROOT / "agent99-deploy.ps1"
+LIVE_PREFLIGHT = ROOT / "scripts/reboot-recovery/agent99-live-preflight.ps1"
 
 EXPECTED_RUNTIME_FILES = (
     "agent99-bootstrap.ps1",
@@ -71,6 +72,7 @@ def test_sender_and_receiver_allow_exactly_the_deployer_runtime_bundle() -> None
     sender = SENDER.read_text(encoding="utf-8")
     receiver = RECEIVER.read_text(encoding="utf-8")
     deployer = DEPLOYER.read_text(encoding="utf-8")
+    live_preflight = LIVE_PREFLIGHT.read_text(encoding="utf-8")
 
     sender_files = _quoted_array(sender, "RUNTIME_FILES=(", ")")
     receiver_files = _quoted_array(receiver, "$FixedRuntimeFiles = @(", ")")
@@ -79,6 +81,11 @@ def test_sender_and_receiver_allow_exactly_the_deployer_runtime_bundle() -> None
     assert sender_files == EXPECTED_RUNTIME_FILES
     assert receiver_files == EXPECTED_RUNTIME_FILES
     assert deployer_files == EXPECTED_RUNTIME_FILES
+    preflight_count = re.search(
+        r"-ExpectedRuntimeFileCount\s+(\d+)", live_preflight
+    )
+    assert preflight_count is not None
+    assert int(preflight_count.group(1)) == len(EXPECTED_RUNTIME_FILES)
     assert "expectedRuntimeFileCount\": 16" in sender
     assert "$filesByName.Count -ne $FixedRuntimeFiles.Count" in receiver
     assert "required_runtime_file_missing" in receiver