fix(recovery): add controlled harbor repair mode

ops/runner/test_cd_controlled_runtime_profile.py

@@ -80,11 +80,33 @@ def test_harbor_login_has_public_route_retry_and_safe_secret_transport() -> None
     assert "docker login" in block
     assert "--password-stdin" in block
     assert "BLOCKER harbor_registry_public_route_unavailable" in block
+    assert "sudo /usr/local/bin/harbor-watchdog.sh --check" in block
+    assert "sudo /usr/local/bin/harbor-watchdog.sh --repair-once" in block
     assert "sleep \"${LOGIN_SLEEP_SECONDS}\"" in block
     assert "${HARBOR_PASSWORD}" in block
     assert "--password " not in block
 
 
+def test_harbor_watchdog_exposes_controlled_check_and_one_shot_repair() -> None:
+    text = (ROOT / "scripts/reboot-recovery/harbor-watchdog.sh").read_text(
+        encoding="utf-8"
+    )
+
+    assert "--check" in text
+    assert "--repair-once" in text
+    assert "--apply-once" in text
+    assert "check_only=true" in text
+    assert "docker_compose_action_performed=false" in text
+    assert "container_remove_performed=false" in text
+    assert "AWOOI_ALLOW_NON_110_HARBOR_REPAIR" not in text
+    assert "AWOOOI_ALLOW_NON_110_HARBOR_REPAIR" in text
+    assert "EXPECTED_HOST_IP" in text
+    assert "192.168.0.110" in text
+    assert "REFUSE harbor repair" in text
+    assert "require_expected_host_for_apply || return 1" in text
+    assert "while true" in text
+
+
 def test_onboarding_warning_step_template_stays_on_controlled_runtime_profile() -> None:
     text = _workflow_text()
     assert "onboarding warning-step workflow is" in text