fix: serialize DEV CD apply

scripts/src/dev-deploy-apply.test.mjs

@@ -14,6 +14,11 @@ import {
   resolveApplySourceCommit,
   resolveDevKubeconfigSelection
 } from "./dev-deploy-apply.mjs";
+import {
+  devCdTransactionGuardFailure,
+  hasDevCdTransactionEnv,
+  requireDevCdTransactionForSideEffect
+} from "./dev-cd-transaction-guard.mjs";
 
 const codeAgentBaseUrl = "http://172.26.26.227:17680/v1/responses";
 
@@ -109,6 +114,33 @@ test("allowlisted suspended template Job image change plans replacement", () =>
   assert.equal(decision.newImage, "127.0.0.1:5000/hwlab/hwlab-agent-worker:new5678");
 });
 
+test("DEV CD transaction guard rejects direct legacy side-effect calls", () => {
+  assert.equal(hasDevCdTransactionEnv({}), false);
+  assert.equal(hasDevCdTransactionEnv({ HWLAB_CD_TRANSACTION_ID: "tx-123" }), true);
+
+  const failure = requireDevCdTransactionForSideEffect({
+    env: {},
+    script: "scripts/dev-deploy-apply.mjs",
+    mode: "--apply"
+  });
+  assert.deepEqual(failure, devCdTransactionGuardFailure({
+    script: "scripts/dev-deploy-apply.mjs",
+    mode: "--apply"
+  }));
+  assert.equal(failure.error, "cd-transaction-required");
+  assert.equal(failure.mutationAttempted, false);
+  assert.match(failure.entrypoint, /scripts\/dev-cd-apply\.mjs/u);
+
+  assert.equal(
+    requireDevCdTransactionForSideEffect({
+      env: { HWLAB_CD_TRANSACTION_ID: "tx-123" },
+      script: "scripts/dev-deploy-apply.mjs",
+      mode: "--apply"
+    }),
+    null
+  );
+});
+
 test("matching allowlisted suspended template Job image does not replace", () => {
   const image = "127.0.0.1:5000/hwlab/hwlab-cli:73b379f";
   const decision = decideDevTemplateJobReplacement({