fix: observe code queue execution plane via tran

scripts/code-queue-execution-plane-contract-test.ts

@@ -3,6 +3,7 @@ import {
   runCodeQueueExecutionPlaneForTest,
   type CodeQueueExecutionPlaneObservation,
 } from "./src/code-queue-execution-plane";
+import { readFileSync } from "node:fs";
 
 type JsonRecord = Record<string, unknown>;
 
@@ -175,12 +176,21 @@ async function checkProgressiveDisclosure(): Promise<void> {
   assertCondition("details" in raw && "rawObservation" in raw, "--raw should include details and raw observation", raw);
 }
 
+async function checkLiveCollectorUsesD601TranTransport(): Promise<void> {
+  const source = readFileSync(new URL("./src/code-queue-execution-plane.ts", import.meta.url), "utf8");
+  assertCondition(source.includes('["D601:k3s", "kubectl", ...args]'), "live collector should observe k3s through D601 tran route, not local kubectl");
+  assertCondition(source.includes('`D601:${options.worktreePath}`'), "worktree observation should run on D601 workspace route");
+  assertCondition(!source.includes('runCommand(["kubectl", ...args]'), "live collector must not call local kubectl directly");
+  assertCondition(!source.includes('runCommand(["git", "-C", options.worktreePath'), "worktree observation must not read local filesystem");
+}
+
 async function main(): Promise<void> {
   const checks = [
     ["code-queue:execution-plane-healthy-no-drift", checkHealthyNoDrift],
     ["code-queue:execution-plane-deployment-drift", checkDeploymentDrift],
     ["code-queue:execution-plane-deprecated-compose-residual", checkDeprecatedComposeResidual],
     ["code-queue:execution-plane-progressive-disclosure", checkProgressiveDisclosure],
+    ["code-queue:execution-plane-d601-tran-transport", checkLiveCollectorUsesD601TranTransport],
   ] as const;
   const results = [];
   for (const [name, check] of checks) {
@@ -193,4 +203,3 @@ async function main(): Promise<void> {
 if (import.meta.main) {
   await main();
 }
-