feat: harden runtime import and frontend verification workflows

internal/provision/runtime_import_service_test.go

@@ -806,3 +806,85 @@ func queryCount(t *testing.T, db *sql.DB, table string) int {
 	}
 	return count
 }
+
+func TestValidateHostReadiness(t *testing.T) {
+	t.Run("all capabilities present", func(t *testing.T) {
+		caps := sub2api.HostCapabilities{
+			Groups:        true,
+			Channels:      true,
+			Accounts:      true,
+			AccountTest:   true,
+			AccountModels: true,
+			Plans:         true,
+			Subscriptions: true,
+		}
+		if err := validateHostReadiness(caps); err != nil {
+			t.Fatalf("validateHostReadiness() = %v, want nil", err)
+		}
+	})
+
+	t.Run("missing groups", func(t *testing.T) {
+		caps := sub2api.HostCapabilities{
+			Groups:      false,
+			Channels:    true,
+			Accounts:    true,
+			AccountTest: true,
+		}
+		if err := validateHostReadiness(caps); err == nil {
+			t.Fatal("validateHostReadiness() = nil, want error for missing groups")
+		} else if !strings.Contains(err.Error(), "groups") {
+			t.Fatalf("validateHostReadiness() = %v, want error mentioning groups", err)
+		}
+	})
+
+	t.Run("missing multiple capabilities", func(t *testing.T) {
+		caps := sub2api.HostCapabilities{
+			Groups:      false,
+			Channels:    false,
+			Accounts:    false,
+			AccountTest: false,
+		}
+		if err := validateHostReadiness(caps); err == nil {
+			t.Fatal("validateHostReadiness() = nil, want error for multiple missing capabilities")
+		}
+	})
+
+	t.Run("missing accounts", func(t *testing.T) {
+		caps := sub2api.HostCapabilities{
+			Groups:      true,
+			Channels:    true,
+			Accounts:    false,
+			AccountTest: true,
+		}
+		if err := validateHostReadiness(caps); err == nil {
+			t.Fatal("validateHostReadiness() = nil, want error for missing accounts")
+		}
+	})
+
+	t.Run("missing test account", func(t *testing.T) {
+		caps := sub2api.HostCapabilities{
+			Groups:      true,
+			Channels:    true,
+			Accounts:    true,
+			AccountTest: false,
+		}
+		if err := validateHostReadiness(caps); err == nil {
+			t.Fatal("validateHostReadiness() = nil, want error for missing account_test")
+		}
+	})
+
+	t.Run("plans and subscriptions not required", func(t *testing.T) {
+		caps := sub2api.HostCapabilities{
+			Groups:        true,
+			Channels:      true,
+			Accounts:      true,
+			AccountTest:   true,
+			AccountModels: false,
+			Plans:         false,
+			Subscriptions: false,
+		}
+		if err := validateHostReadiness(caps); err != nil {
+			t.Fatalf("validateHostReadiness() = %v, want nil (plans/subscriptions are optional)", err)
+		}
+	})
+}