fix(ops): enforce Prometheus runtime identity

tests/test_metrics_edge_controlled_apply_service.py

@@ -144,6 +144,24 @@ def test_prometheus_config_sha_detects_stale_container_mount(tmp_path: Path, mon
     assert container_sha == stale_sha
 
 
+def test_prometheus_identity_verifier_requires_same_image_and_data_volume():
+    from services.metrics_edge_controlled_apply_service import (
+        _prometheus_identity_preserved,
+    )
+
+    before = {"image_id": "image-a", "data_volume": "volume-a"}
+
+    assert _prometheus_identity_preserved(before, dict(before)) is True
+    assert _prometheus_identity_preserved(
+        before,
+        {"image_id": "image-b", "data_volume": "volume-a"},
+    ) is False
+    assert _prometheus_identity_preserved(
+        before,
+        {"image_id": "image-a", "data_volume": "volume-b"},
+    ) is False
+
+
 def test_render_rejects_incomplete_templates():
     from services.metrics_edge_controlled_apply_service import (
         render_nginx_config,