fix: harden v02 bun runtime rollout

scripts/g14-gitops-render.test.ts

@@ -24,6 +24,37 @@ test("v02 render follows TypeScript runtime checks and does not self-patch boots
     assert.match(pipeline, /127\.0\.0\.1:5000\/hwlab\/hwlab-ci-node-tools:node22-alpine-bun-v1/u);
     assert.match(pipeline, /node scripts\/run-bun\.mjs test cmd\/hwlab-codex-api-responses-forwarder\/main\.test\.ts/u);
     assert.doesNotMatch(pipeline, /cmd\/hwlab-codex-api-responses-forwarder\/main\.mjs/u);
+    assert.match(pipeline, /process\.exitCode = 1/u);
+    assert.match(pipeline, /item\.spec\?\.template\?\.metadata\?\.labels\?\.\[\\"hwlab\.pikastech\.local\/source-commit\\"\]/u);
+
+    const removedServiceIds = [
+      "hwlab-router",
+      "hwlab-tunnel-client",
+      "hwlab-gateway-simu",
+      "hwlab-box-simu",
+      "hwlab-patch-panel"
+    ];
+    for (const serviceId of removedServiceIds) {
+      assert.doesNotMatch(pipeline, new RegExp(`build-${serviceId}`, "u"));
+    }
+
+    const workloads = await readFile(path.join(outDir, "runtime-v02", "workloads.yaml"), "utf8");
+    const services = await readFile(path.join(outDir, "runtime-v02", "services.yaml"), "utf8");
+    for (const serviceId of removedServiceIds) {
+      assert.doesNotMatch(workloads, new RegExp(serviceId, "u"));
+      assert.doesNotMatch(services, new RegExp(serviceId, "u"));
+    }
+
+    assert.doesNotMatch(pipeline, /hwlab-gateway-simu-status/u);
+    assert.match(pipeline, /hwlab-cloud-api-status/u);
+
+    const application = await readFile(path.join(outDir, "argocd", "application-v02.yaml"), "utf8");
+    assert.match(application, /"prune": true/u);
+
+    for (const generatedFile of ["deepseek-proxy.yaml", "postgres.yaml", "g14-frpc.yaml"]) {
+      const content = await readFile(path.join(outDir, "runtime-v02", generatedFile), "utf8");
+      assert.match(content, /"hwlab\.pikastech\.local\/source-commit"/u);
+    }
 
     const reconciler = await readFile(path.join(outDir, "tekton-v02", "control-plane-reconciler.yaml"), "utf8");
     assert.match(reconciler, /cross-namespace-rbac-bootstrap-managed/u);