fix: serialize DEV CD apply

scripts/src/dev-deploy-apply.mjs

@@ -17,6 +17,7 @@ import {
 } from "../../internal/cloud/code-agent-contract.mjs";
 import { activeReportLifecycle } from "../../internal/dev-report-lifecycle.mjs";
 import { DEV_ENDPOINT, ENVIRONMENT_DEV, SERVICE_IDS } from "../../internal/protocol/index.mjs";
+import { requireDevCdTransactionForSideEffect } from "./dev-cd-transaction-guard.mjs";
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
 const reportPath = "reports/dev-gate/dev-deploy-report.json";
@@ -72,7 +73,7 @@ const requiredValidationCommands = [
   "node --check scripts/src/dev-deploy-apply.mjs",
   "node scripts/dev-deploy-apply.mjs --dry-run --expect-blocked"
 ];
-const applyCommand = "node scripts/dev-deploy-apply.mjs --apply --confirm-dev --confirmed-non-production --write-report";
+const applyCommand = "node scripts/dev-cd-apply.mjs --apply --confirm-dev --confirmed-non-production --write-report";
 const dryRunPlanCommand = "node scripts/dev-deploy-apply.mjs --dry-run --write-report";
 const blockedDryRunCommand = "node scripts/dev-deploy-apply.mjs --dry-run --expect-blocked --write-report";
 const forbiddenActions = [
@@ -1771,6 +1772,17 @@ export async function runDevDeployApply(argv, io = {}) {
   const args = parseArgs(argv);
   const blockers = [];
   validateArgs(args, blockers);
+  if (args.apply) {
+    const transactionGuard = requireDevCdTransactionForSideEffect({
+      env: io.env ?? process.env,
+      script: "scripts/dev-deploy-apply.mjs",
+      mode: "--apply"
+    });
+    if (transactionGuard) {
+      stdout.write(`${JSON.stringify(transactionGuard, null, 2)}\n`);
+      return 2;
+    }
+  }
   const gitHeadCommitIdPromise = gitHeadCommit();
 
   const [deploy, catalog, devKustomization, namespaceDoc, workloads, services, healthContract] = await Promise.all([