fix(device-plane): reconcile failed manager activation

infra/deploy-runner/build-device-manager-control-plane-artifact.mjs

@@ -4,7 +4,7 @@ import { spawnSync } from "node:child_process";
 import { cp, lstat, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join, relative, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 const scriptDir = dirname(fileURLToPath(import.meta.url));
 const platformRoot = resolve(scriptDir, "../..");
@@ -50,6 +50,27 @@ try {
     }
     await copySafe(resolve(devicePlaneRoot, entry), join(payload, entry), devicePlaneRoot);
   }
+  const coreImport = spawnSync(
+    process.execPath,
+    [
+      "--input-type=module",
+      "--eval",
+      `import(${JSON.stringify(pathToFileURL(join(
+        payload,
+        "services/device-control-core/src/sensitive-reference-management.mjs",
+      )).href)})`,
+    ],
+    {
+      cwd: payload,
+      encoding: "utf8",
+      maxBuffer: 16 * 1024 * 1024,
+    },
+  );
+  if (coreImport.status !== 0) {
+    throw new Error(
+      `device_control_core_staged_module_import_failed:${coreImport.stderr || coreImport.stdout}`,
+    );
+  }
   const compose = await readFile(join(payload, "docker-compose.device-manager.yml"), "utf8");
   for (const required of [
     "device-manager:",