fix(agent): preserve executor boundary runtime proof

apps/api/tests/test_ai_agent_autonomous_runtime_control.py

@@ -2590,9 +2590,13 @@ def test_runtime_operation_latest_queries_prioritize_latest_apply_chain() -> Non
     for sql in (_RUNTIME_OPERATION_LATEST_SQL, _RUNTIME_OPERATION_LATEST_DIRECT_SQL):
         assert "WITH latest_apply_chain AS" in sql
         assert "AND status IN ('success', 'failed')" in sql
-        assert "operation_row.op_id::text = latest_apply_chain.apply_op_id" in sql
-        assert "operation_row.op_id::text = latest_apply_chain.check_mode_op_id" in sql
-        assert "operation_row.op_id::text = latest_apply_chain.candidate_op_id" in sql
+        assert "LEFT JOIN latest_apply_chain ON TRUE" in sql
+        assert "operation_row.op_id::text IN" in sql
+        assert "latest_apply_chain.apply_op_id" in sql
+        assert "latest_apply_chain.check_mode_op_id" in sql
+        assert "latest_apply_chain.candidate_op_id" in sql
+        assert "operation_row.operation_type IN" in sql
+        assert "'remediation_executed'" in sql
 
 
 def test_execution_capability_lifecycle_requires_same_run_terminal_receipt() -> None:

apps/api/tests/test_signal_worker_ansible_executor_binding.py

@@ -157,6 +157,8 @@ def test_cd_prunes_and_verifies_api_executor_boundary_in_production() -> None:
     assert "awoooi_executor_boundary_verification_v1" in workflow
     assert "executor_boundary_public_readback=verified_ready" in workflow
     assert "verified_source_sha" in workflow
+    assert "argocd.argoproj.io/sync-options=Prune=false" in workflow
+    assert "argocd.argoproj.io/compare-options=IgnoreExtraneous" in workflow
     assert "github.com/kubernetes-sigs/kustomize" not in workflow
     assert "git checkout --force -B main FETCH_HEAD" in workflow