test(cd): align merged runtime contracts

.gitea/workflows/cd.yaml

@@ -3053,7 +3053,7 @@ jobs:
           else
             # A transient guest SSH outage must not overwrite trust data, but it
             # also must not blindly green-light the deploy. Decode only on the
-            # K3s controller, verify all five public host entries, then delete
+            # K3s controller, verify all six public host entries, then delete
             # the temporary file without printing its contents.
             EXISTING_KNOWN_HOSTS=/tmp/known_hosts_existing
             EXISTING_PRESENT=0

apps/api/tests/test_cd_known_hosts_recovery_gate.py

@@ -11,7 +11,7 @@ def test_cd_known_hosts_gate_retries_and_verifies_preserved_secret() -> None:
 
     assert "for scan_attempt in 1 2 3" in gate
     assert 'sleep "\\$scan_attempt"' in gate
-    assert "existing ssh-mcp-key verified 5/5 and preserved" in gate
+    assert "existing ssh-mcp-key verified 6/6 and preserved" in gate
     assert "EXISTING_PRESENT=\\$((EXISTING_PRESENT + 1))" in gate
     assert 'if [ "\\$EXISTING_PRESENT" -eq "\\$EXPECTED_HOSTS" ]' in gate
     assert 'rm -f "\\$EXISTING_KNOWN_HOSTS"' in gate

apps/api/tests/test_sre_k3s_controlled_automation_work_items_api.py

@@ -155,8 +155,8 @@ def test_loader_returns_fixed_architecture_provider_order_and_agent99_bridge() -
         "active_or_completed_commitments": 68,
         "by_status": {
             "analysis_or_governance_complete": 6,
-            "source_implemented_runtime_pending": 34,
-            "in_progress": 27,
+            "source_implemented_runtime_pending": 35,
+            "in_progress": 26,
             "not_started_or_no_current_evidence": 1,
             "superseded": 2,
         },