feat(control-plane): harden host-scoped reconcile and acceptance evidence

- add batch-scoped reconcile_runs persistence and queries
- route batch detail and reconcile writes through batch_id/host_id
- refresh production boards with host-scope acceptance artifacts
- include latest real-host acceptance evidence for self_service and subscription

internal/pack/source_loader_test.go

@@ -2,8 +2,10 @@ package pack
 
 import (
 	"archive/zip"
+	"bufio"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -46,10 +48,26 @@ func writePackArchive(t *testing.T, archivePath string) {
 	defer writer.Close()
 
 	sourceRoot := filepath.Join("..", "..", "packs", "openai-cn-pack")
-	files := []string{
-		"pack.json",
-		"checksums.txt",
-		filepath.Join("providers", "deepseek.json"),
+	files := []string{"pack.json", "checksums.txt"}
+	checksumFile, err := os.Open(filepath.Join(sourceRoot, "checksums.txt"))
+	if err != nil {
+		t.Fatalf("os.Open(checksums.txt) error = %v", err)
+	}
+	defer checksumFile.Close()
+	scanner := bufio.NewScanner(checksumFile)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" {
+			continue
+		}
+		parts := strings.Fields(line)
+		if len(parts) != 2 {
+			t.Fatalf("invalid checksum line %q", line)
+		}
+		files = append(files, filepath.FromSlash(parts[1]))
+	}
+	if err := scanner.Err(); err != nil {
+		t.Fatalf("scan checksums.txt error = %v", err)
 	}
 	for _, relativePath := range files {
 		body, err := os.ReadFile(filepath.Join(sourceRoot, relativePath))