fix(agent99): bind completion callback credential

apps/api/tests/test_agent99_transport_recovery_deploy_contract.py

@@ -207,6 +207,29 @@ def test_agent99_completion_callback_waits_for_durable_same_trace_readback() ->
     assert 'secretValueLogged = $false' in source
 
 
+def test_agent99_completion_token_is_bound_without_reusing_telegram_secret() -> None:
+    api_deployment = (ROOT / "k8s/awoooi-prod/06-deployment-api.yaml").read_text()
+    worker_deployment = (
+        ROOT / "k8s/awoooi-prod/08-deployment-worker.yaml"
+    ).read_text()
+    provisioner = (
+        ROOT / "scripts/reboot-recovery/agent99-provision-completion-token.sh"
+    ).read_text()
+
+    for deployment in (api_deployment, worker_deployment):
+        assert "name: AGENT99_SRE_ALERT_RELAY_TOKEN" in deployment
+        assert "key: AGENT99_SRE_ALERT_RELAY_TOKEN" in deployment
+
+    assert "AGENT99_SRE_RELAY_TOKEN" in provisioner
+    assert "openssl rand -hex 32" in provisioner
+    assert "--patch-file=/dev/stdin" in provisioner
+    assert "SetEnvironmentVariable" in provisioner
+    assert "OPENCLAW_TG_BOT_TOKEN" not in provisioner
+    assert "TELEGRAM_BOT_TOKEN" not in provisioner
+    assert "set -x" not in provisioner
+    assert 'echo "$token"' not in provisioner
+
+
 def test_load_shedding_requires_configured_post_verifier() -> None:
     source = CONTROL.read_text(encoding="utf-8")
     function = source[source.index("function Invoke-LoadShedding") :]