feat(awooop): expose repair candidate automation closure

apps/api/tests/test_repair_candidate_service.py

@@ -359,6 +359,20 @@ async def test_candidate_blocked_observe_only_prompts_repair_playbook_draft() ->
     assert "maintenance_window" in promotion_contract["blocked_fields"]
     assert promotion_contract["runtime_execution_authorized"] is False
     assert promotion_contract["runtime_write_allowed"] is False
+    closure = promotion_contract["controlled_automation_closure"]
+    assert closure["schema_version"] == "repair_candidate_controlled_automation_closure_v1"
+    assert closure["status"] == "owner_review_ready_no_write_rehearsal"
+    assert closure["runtime_write_gate"] == "closed_until_owner_release"
+    assert closure["no_write_rehearsal"]["status"] == "ready_for_owner_review"
+    assert closure["no_write_rehearsal"]["executes_command"] is False
+    assert closure["verifier_writeback_plan"]["status"] == "planned_not_executed"
+    assert "incident_timeline" in closure["verifier_writeback_plan"]["writes_after_execution"]
+    assert [item["asset_type"] for item in closure["automation_asset_ledger"]] == [
+        "KM",
+        "PlayBook",
+        "ScriptOrAnsible",
+        "Verifier",
+    ]
     assert result.metadata["repair_candidate_promotion_contract"] == promotion_contract
     assert "promotion=6/11" in result.metadata["repair_candidate_promotion_summary"]
     assert "runtime=false" in result.metadata["repair_candidate_promotion_summary"]