refactor(platform): harden LAB evidence and telemetry

tests/test_telegraf_deployment_contracts.py

@@ -0,0 +1,32 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[1]
+TELEGRAF_ROOT = REPOSITORY_ROOT / "deploy" / "telemetry-plane" / "telegraf"
+RECOVERY_ACTIONS = "restart/5000/restart/30000/restart/60000"
+
+
+def test_install_configures_bounded_service_recovery() -> None:
+    script = (TELEGRAF_ROOT / "Install-NdcMissionCoreTelegraf.ps1").read_text(encoding="utf-8")
+
+    assert "sc.exe failure $serviceName reset= 86400" in script
+    assert RECOVERY_ACTIONS in script
+    assert "sc.exe failureflag $serviceName 1" in script
+    assert "RecoveryConfigured = $true" in script
+
+
+def test_update_configures_recovery_inside_rollback_boundary() -> None:
+    script = (TELEGRAF_ROOT / "Update-NdcMissionCoreTelegraf.ps1").read_text(encoding="utf-8")
+
+    recovery = script.index("sc.exe failure $serviceName reset= 86400")
+    rollback = script.index("Stop-Service -Name $serviceName -Force", recovery)
+    restore_environment = script.index(
+        "-Type MultiString -Value $serviceEnvironmentBefore",
+        rollback,
+    )
+    restart = script.index("Start-Service -Name $serviceName", restore_environment)
+    assert recovery < rollback < restore_environment < restart
+    assert RECOVERY_ACTIONS in script
+    assert "sc.exe failureflag $serviceName 1" in script
+    assert "RecoveryConfigured = $true" in script