fix: observe code queue execution plane via tran

scripts/code-queue-execution-plane-contract-test.ts

@@ -3,6 +3,7 @@ import {
   runCodeQueueExecutionPlaneForTest,
   type CodeQueueExecutionPlaneObservation,
 } from "./src/code-queue-execution-plane";
+import { readFileSync } from "node:fs";
 
 type JsonRecord = Record<string, unknown>;
 
@@ -175,12 +176,21 @@ async function checkProgressiveDisclosure(): Promise<void> {
   assertCondition("details" in raw && "rawObservation" in raw, "--raw should include details and raw observation", raw);
 }
 
+async function checkLiveCollectorUsesD601TranTransport(): Promise<void> {
+  const source = readFileSync(new URL("./src/code-queue-execution-plane.ts", import.meta.url), "utf8");
+  assertCondition(source.includes('["D601:k3s", "kubectl", ...args]'), "live collector should observe k3s through D601 tran route, not local kubectl");
+  assertCondition(source.includes('`D601:${options.worktreePath}`'), "worktree observation should run on D601 workspace route");
+  assertCondition(!source.includes('runCommand(["kubectl", ...args]'), "live collector must not call local kubectl directly");
+  assertCondition(!source.includes('runCommand(["git", "-C", options.worktreePath'), "worktree observation must not read local filesystem");
+}
+
 async function main(): Promise<void> {
   const checks = [
     ["code-queue:execution-plane-healthy-no-drift", checkHealthyNoDrift],
     ["code-queue:execution-plane-deployment-drift", checkDeploymentDrift],
     ["code-queue:execution-plane-deprecated-compose-residual", checkDeprecatedComposeResidual],
     ["code-queue:execution-plane-progressive-disclosure", checkProgressiveDisclosure],
+    ["code-queue:execution-plane-d601-tran-transport", checkLiveCollectorUsesD601TranTransport],
   ] as const;
   const results = [];
   for (const [name, check] of checks) {
@@ -193,4 +203,3 @@ async function main(): Promise<void> {
 if (import.meta.main) {
   await main();
 }
-

scripts/src/code-queue-execution-plane.ts

@@ -248,6 +248,13 @@ function commandProbe(result: CommandResult): ProbeResult {
   };
 }
 
+function runTran(args: string[], options: ExecutionPlaneOptions, timeoutMs = options.timeoutMs): ProbeResult {
+  return commandProbe(runCommand(["./scripts/tran", ...args], repoRoot, {
+    timeoutMs,
+    env: process.env,
+  }));
+}
+
 function safeError(probe: ProbeResult): string | null {
   if (probe.ok) return null;
   const text = firstLine(probe.stderr) ?? firstLine(probe.stdout);
@@ -255,10 +262,7 @@ function safeError(probe: ProbeResult): string | null {
 }
 
 function runKubectl(args: string[], options: ExecutionPlaneOptions): ProbeResult {
-  return commandProbe(runCommand(["kubectl", ...args], repoRoot, {
-    timeoutMs: options.timeoutMs,
-    env: { ...process.env, KUBECONFIG: options.kubeconfig },
-  }));
+  return runTran(["D601:k3s", "kubectl", ...args], options);
 }
 
 function collectGuard(options: ExecutionPlaneOptions): { guard: D601K3sGuardClassification; diagnostics: Record<string, unknown> } {
@@ -436,7 +440,7 @@ function collectServices(options: ExecutionPlaneOptions): ServiceObservation[] {
 }
 
 function collectWorktree(options: ExecutionPlaneOptions): WorktreeObservation {
-  const probe = commandProbe(runCommand(["git", "-C", options.worktreePath, "rev-parse", "HEAD"], repoRoot, { timeoutMs: 5_000 }));
+  const probe = runTran([`D601:${options.worktreePath}`, "argv", "git", "rev-parse", "HEAD"], options, 10_000);
   return {
     path: options.worktreePath,
     ok: probe.ok,
@@ -446,7 +450,16 @@ function collectWorktree(options: ExecutionPlaneOptions): WorktreeObservation {
 }
 
 function collectResidual(): ResidualObservation {
-  const docker = commandProbe(runCommand(["docker", "ps", "-a", "--filter", "name=code-queue-backend", "--format", "{{.Names}}\t{{.Status}}\t{{.Image}}"], repoRoot, { timeoutMs: 8_000 }));
+  const remoteOptions: ExecutionPlaneOptions = {
+    namespace: expectedNamespace,
+    kubeconfig: d601NativeKubeconfig,
+    worktreePath: expectedWorktreePath,
+    full: false,
+    raw: false,
+    skipProbe: true,
+    timeoutMs: 15_000,
+  };
+  const docker = runTran(["D601", "argv", "docker", "ps", "-a", "--filter", "name=code-queue-backend", "--format", "{{.Names}}\t{{.Status}}\t{{.Image}}"], remoteOptions, 15_000);
   const containers = docker.ok
     ? lines(docker.stdout).map((line) => {
         const fields = line.split("\t");
@@ -454,7 +467,7 @@ function collectResidual(): ResidualObservation {
       }).filter((item) => item.name === "code-queue-backend" || item.name.includes("code-queue-backend"))
     : [];
 
-  const ss = commandProbe(runCommand(["ss", "-H", "-ltnp"], repoRoot, { timeoutMs: 8_000 }));
+  const ss = runTran(["D601", "argv", "ss", "-H", "-ltnp"], remoteOptions, 15_000);
   const listeners = ss.ok
     ? (lines(ss.stdout)
         .filter((line) => line.includes(":4222"))