fix: clean stale M3 simulator deployments (#285)

Co-authored-by: Code Queue Review <code-queue-review@localhost>

scripts/src/dev-deploy-apply.test.mjs

@@ -4,6 +4,7 @@ import test from "node:test";
 import {
   buildKubectlCommandPrefix,
   compareRuntimeIdentityEnv,
+  decideDevLegacySimulatorDeploymentCleanup,
   decideDevTemplateJobReplacement,
   formatKubeconfigAccessFailure,
   inspectCodeAgentProviderDesiredState,
@@ -150,6 +151,71 @@ test("replacement policy refuses non-allowlisted or active Jobs", () => {
   assert.equal(active.result, "blocked");
 });
 
+test("allowlisted stale simulator Deployment plans cleanup only with StatefulSet replacement", () => {
+  const decision = decideDevLegacySimulatorDeploymentCleanup({
+    deploymentName: "hwlab-box-simu",
+    deploymentNamespace: "hwlab-dev",
+    desiredReplacementExists: true,
+    desiredReplacementKind: "StatefulSet",
+    liveExists: true,
+    oldImages: [
+      {
+        name: "hwlab-box-simu",
+        serviceId: "hwlab-box-simu",
+        image: "127.0.0.1:5000/hwlab/hwlab-box-simu:old1234"
+      }
+    ],
+    newImages: [
+      {
+        name: "hwlab-box-simu",
+        serviceId: "hwlab-box-simu",
+        image: "127.0.0.1:5000/hwlab/hwlab-box-simu:new5678"
+      }
+    ]
+  });
+
+  assert.equal(decision.cleanup, true);
+  assert.equal(decision.result, "planned");
+  assert.equal(decision.namespace, "hwlab-dev");
+  assert.equal(decision.deploymentName, "hwlab-box-simu");
+  assert.equal(decision.serviceId, "hwlab-box-simu");
+  assert.equal(decision.desiredReplacementKind, "StatefulSet");
+  assert.equal(decision.oldImage, "127.0.0.1:5000/hwlab/hwlab-box-simu:old1234");
+  assert.equal(decision.newImage, "127.0.0.1:5000/hwlab/hwlab-box-simu:new5678");
+});
+
+test("legacy simulator cleanup refuses non-DEV or missing replacement cleanup", () => {
+  const wrongNamespace = decideDevLegacySimulatorDeploymentCleanup({
+    deploymentName: "hwlab-gateway-simu",
+    deploymentNamespace: "hwlab-prod",
+    desiredReplacementExists: true,
+    desiredReplacementKind: "StatefulSet",
+    liveExists: true
+  });
+  assert.equal(wrongNamespace.cleanup, false);
+  assert.equal(wrongNamespace.result, "blocked");
+
+  const missingReplacement = decideDevLegacySimulatorDeploymentCleanup({
+    deploymentName: "hwlab-gateway-simu",
+    deploymentNamespace: "hwlab-dev",
+    desiredReplacementExists: false,
+    desiredReplacementKind: null,
+    liveExists: true
+  });
+  assert.equal(missingReplacement.cleanup, false);
+  assert.equal(missingReplacement.result, "blocked");
+
+  const ignored = decideDevLegacySimulatorDeploymentCleanup({
+    deploymentName: "hwlab-cloud-api",
+    deploymentNamespace: "hwlab-dev",
+    desiredReplacementExists: true,
+    desiredReplacementKind: "StatefulSet",
+    liveExists: true
+  });
+  assert.equal(ignored.cleanup, false);
+  assert.equal(ignored.result, "ignored");
+});
+
 test("apply source commit follows deploy/catalog artifact identity", () => {
   assert.equal(
     resolveApplySourceCommit({ commitId: "73b379f" }, { commitId: "73b379f" }, "cb35ada68606"),