fix(agent99): align deploy contract with bounded runner

agent99-contract-check.ps1

@@ -205,7 +205,9 @@ $signozMetadataExecutorContract = [bool](
 Add-Check "backup:signoz_metadata_fixed_executor" $signozMetadataExecutorContract "Windows99 dispatches one fixed host110 metadata export contract, consumes only a root-owned credential reference on target, and requires the independent bundle verifier without raw SQLite or secret output"
 Add-Check "recovery:auto_trigger" ($control.Contains("Get-AgentBootState") -and $control.Contains("Start-AgentRecoveryFromObservation") -and $control.Contains("Enter-AgentRecoveryTriggerReservation") -and $control.Contains('"recovery-trigger-reservation.lock"') -and $control.Contains('[System.IO.FileShare]::None') -and $control.Contains('reason = "recovery_trigger_reservation_busy"') -and $control.Contains("recovery_already_queued")) "boot and host-down recovery reserve one atomic single-flight queue decision"
 Add-Check "recovery:auto_trigger_controlled_identity" ($control.Contains("New-AgentObservedRecoveryDispatchIdentity") -and $control.Contains('-RouteId "agent99_local_observer"') -and $control.Contains('schema_version = "agent99_controlled_dispatch_identity_v1"') -and $control.Contains('correlationKey = $dispatchIdentity.idempotencyKey') -and $control.Contains('canonicalDigest = $dispatchIdentity.canonicalDigest') -and $control.Contains("Invoke-AgentControlledDispatchIdentitySelfTest")) "observer-created Recover requests carry a stable canonical controlled dispatch identity before queue processing"
-Add-Check "recovery:queue_identity_fail_closed" ($control.Contains('dispatchIdentitySchemaVersion = $dispatchIdentity.schemaVersion') -and $control.Contains('Test-AgentControlledDispatchIdentity $dispatchIdentityEnvelope') -and $control.Contains('"controlled_dispatch_identity_invalid"') -and $control.IndexOf('"controlled_dispatch_identity_invalid"') -lt $control.IndexOf('$process = Start-Process -FilePath "powershell.exe" -ArgumentList $args')) "queue consumer rebuilds and validates canonical identity before any controlled executor starts"
+$queueIdentityRejectionIndex = $control.IndexOf('"controlled_dispatch_identity_invalid"')
+$queueBoundedExecutorIndex = $control.IndexOf('$execution = Invoke-AgentBoundedProcess')
+Add-Check "recovery:queue_identity_fail_closed" ($control.Contains('dispatchIdentitySchemaVersion = $dispatchIdentity.schemaVersion') -and $control.Contains('Test-AgentControlledDispatchIdentity $dispatchIdentityEnvelope') -and $queueIdentityRejectionIndex -ge 0 -and $queueBoundedExecutorIndex -ge 0 -and $queueIdentityRejectionIndex -lt $queueBoundedExecutorIndex -and $control.Contains('-FilePath $powershellPath') -and $control.Contains('-TimeoutSeconds $script:Agent99QueueOuterDeadlineSeconds') -and -not $control.Contains('$process = Start-Process -FilePath "powershell.exe" -ArgumentList $args')) "queue consumer rebuilds and validates canonical identity before the bounded controlled executor starts"
 Add-Check "recovery:durable_boot_event" ($control.Contains("pendingRecovery") -and $control.Contains("host_reboot_recovery_pending") -and $control.Contains("Update-AgentBootRecoveryState") -and $control.Contains("recovered_late")) "boot event remains pending until verified recovery terminal"
 Add-Check "recovery:terminal_evidence_budget" ($taskRegistration.Contains('$recoverySettings') -and $taskRegistration.Contains('New-TimeSpan -Minutes 20')) "startup recovery outlives the ten-minute SLO long enough to write terminal evidence"
 Add-Check "recovery:slo" ($control.Contains("recovery_slo_result") -and $control.Contains("withinSlo")) "10-minute recovery evidence is present"

apps/api/tests/test_agent99_transport_recovery_deploy_contract.py

@@ -118,6 +118,21 @@ def test_agent99_auto_recovery_is_single_flight_and_slo_measured() -> None:
     assert '$process = Start-Process -FilePath "powershell.exe"' not in consumer
     assert 'Add-Check "recovery:auto_trigger_controlled_identity"' in contract
     assert 'Add-Check "recovery:queue_identity_fail_closed"' in contract
+    assert "$queueIdentityRejectionIndex = $control.IndexOf" in contract
+    assert "$queueBoundedExecutorIndex = $control.IndexOf" in contract
+    assert "'$execution = Invoke-AgentBoundedProcess'" in contract
+    assert "$queueIdentityRejectionIndex -ge 0" in contract
+    assert "$queueBoundedExecutorIndex -ge 0" in contract
+    assert "$queueIdentityRejectionIndex -lt $queueBoundedExecutorIndex" in contract
+    assert "-TimeoutSeconds $script:Agent99QueueOuterDeadlineSeconds" in contract
+    assert (
+        '-not $control.Contains(\'$process = Start-Process -FilePath "powershell.exe" '
+        "-ArgumentList $args')"
+    ) in contract
+    assert (
+        '$control.IndexOf(\'$process = Start-Process -FilePath "powershell.exe" '
+        "-ArgumentList $args')"
+    ) not in contract
     assert 'correlationKey = $dispatchIdentity.idempotencyKey' in contract
     assert 'canonicalDigest = $dispatchIdentity.canonicalDigest' in contract
     assert 'Record-AgentEvent "recovery_slo_result"' in source