fix(observability): verify root-owned SigNoz bundle

scripts/ops/tests/test_signoz_metadata_toolchain_deploy.py

@@ -174,6 +174,13 @@ def test_shared_operation_lock_is_existing_read_only_and_fail_closed() -> None:
     assert "exec 8>>/tmp/awoooi-signoz-backup-operation.lock" not in source
 
 
+def test_remote_check_uses_privileged_read_only_visibility() -> None:
+    source = DEPLOYER.read_text(encoding="utf-8")
+    remote_check = source.split("remote_check() {", 1)[1].split("\n}", 1)[0]
+    assert '"${TARGET_HOST}" sudo -n bash -s --' in remote_check
+    assert "REMOTE_CHECK contains only stat/hash/process/API" in remote_check
+
+
 def test_exact_five_file_supply_chain_and_modes_are_fixed() -> None:
     source = DEPLOYER.read_text(encoding="utf-8")
     for path in (