fix(web): 接入 Kali 112 只讀快照

scripts/security/security-mirror-progress-guard.py

@@ -76,6 +76,7 @@ def validate(root: Path) -> None:
     primary_gate = load_json(security_dir / "source-control-primary-readiness-gate.snapshot.json")
     rollout_policy = load_json(security_dir / "security-rollout-policy.snapshot.json")
     iwooos_projection = load_json(security_dir / "iwooos-posture-projection.snapshot.json")
+    kali_status = load_json(security_dir / "kali-integration-status.snapshot.json")
     iwooos_projection_page = (
         root / "apps" / "web" / "src" / "app" / "[locale]" / "iwooos" / "page.tsx"
     ).read_text(encoding="utf-8")
@@ -5552,6 +5553,37 @@ def validate(root: Path) -> None:
         "docs/security/kali-integration-status.snapshot.json",
     ]:
         assert_contains("iwooos_projection.evidence_refs", iwooos_projection["evidence_refs"], evidence_ref)
+    latest_kali_observation = kali_status["latest_read_only_observation"]
+    assert_equal(
+        "kali_status.latest_read_only_observation.observed_at_taipei",
+        latest_kali_observation["observed_at_taipei"],
+        "2026-05-31T17:22:20+08:00",
+    )
+    assert_equal(
+        "kali_status.latest_read_only_observation.collection_mode",
+        latest_kali_observation["collection_mode"],
+        "ssh_batch_read_only_existing_key",
+    )
+    assert_equal(
+        "kali_status.latest_read_only_observation.upgradable_package_count",
+        latest_kali_observation["upgradable_package_count"],
+        1994,
+    )
+    assert_equal(
+        "kali_status.latest_read_only_observation.failed_systemd_unit_count",
+        latest_kali_observation["failed_systemd_unit_count"],
+        1,
+    )
+    for forbidden_runtime_flag in [
+        "runtime_actions_executed",
+        "active_scan_executed",
+        "package_update_executed",
+        "host_reboot_executed",
+    ]:
+        assert_false(
+            f"kali_status.latest_read_only_observation.{forbidden_runtime_flag}",
+            latest_kali_observation[forbidden_runtime_flag],
+        )
     for output in [
         "display_security_posture",
         "display_progress_estimate",