feat(awooop): expose controlled execution preflight

apps/api/tests/test_awooop_operator_timeline_labels.py

@@ -1901,6 +1901,34 @@ def test_awooop_status_chain_does_not_treat_ansible_check_mode_as_repair() -> No
     assert closure["closure_tasks"][3]["source_asset_id"] == (
         "agent-result-capture-release-verifier-preflight-gate:P2-136"
     )
+    controlled_execution = closure["controlled_execution_preflight"]
+    assert controlled_execution["schema_version"] == (
+        "awooop_controlled_execution_preflight_v1"
+    )
+    assert controlled_execution["status"] == "blocked_before_runtime_gate"
+    assert controlled_execution["runtime_execution_authorized"] is False
+    assert controlled_execution["runtime_write_allowed"] is False
+    assert controlled_execution["candidate_route_count"] == 1
+    assert controlled_execution["allowed_route_count"] == 0
+    assert controlled_execution["ready_count"] == 2
+    assert controlled_execution["total_count"] == 7
+    assert controlled_execution["blocked_count"] == 5
+    assert [item["key"] for item in controlled_execution["prerequisites"]] == [
+        "dry_run_passed",
+        "allowlisted_route_candidate",
+        "owner_release_receipt",
+        "maintenance_window",
+        "rollback_owner",
+        "post_apply_verifier",
+        "km_playbook_writeback",
+    ]
+    assert controlled_execution["routes"][0]["route_id"] == (
+        "ansible-allowlisted-apply:ansible:188-ai-web"
+    )
+    assert controlled_execution["routes"][0]["allowed"] is False
+    assert controlled_execution["routes"][0]["apply_playbook_path"] == (
+        "infra/ansible/playbooks/188-ai-web.yml"
+    )
     assert chain["execution"]["ansible"]["check_mode_total"] == 1
     assert chain["execution"]["ansible"]["apply_total"] == 0
     assert chain["execution"]["ansible"]["applied"] is False