fix(recovery): detect all-host reboot recovery gaps

scripts/reboot-recovery/install-reboot-auto-recovery-slo-110.sh

@@ -209,7 +209,10 @@ create_payload() {
     --exclude='.pytest_cache' \
     -czf "$tarball" \
     scripts/reboot-recovery \
-    scripts/security
+    scripts/security \
+    ops/maintenance \
+    ops/monitoring \
+    docs/runbooks/PUBLIC-MAINTENANCE-FALLBACK-RUNBOOK.md
 }
 
 print_plan
@@ -219,6 +222,7 @@ case "$MODE" in
     cat <<DRYRUN
 DRY_RUN=1
 would_create_tarball_from=$ROOT_DIR/scripts/reboot-recovery,$ROOT_DIR/scripts/security
+would_include_source_gates=$ROOT_DIR/ops/maintenance,$ROOT_DIR/ops/monitoring,$ROOT_DIR/docs/runbooks/PUBLIC-MAINTENANCE-FALLBACK-RUNBOOK.md
 would_copy_tarball_to=$HOST:$REMOTE_TARBALL
 would_enable_timer=${UNIT_NAME}.timer
 would_start_service_once=$RUN_ONCE

scripts/reboot-recovery/tests/test_reboot_auto_recovery_slo_installer.py

@@ -23,6 +23,7 @@ def test_installer_dry_run_exposes_apply_rollback_and_verify_contract() -> None:
     assert "target_selector=host_110_systemd_timer:awoooi-reboot-auto-recovery-slo.timer" in result.stdout
     assert "rollback_command=bash scripts/reboot-recovery/install-reboot-auto-recovery-slo-110.sh --rollback" in result.stdout
     assert "verify_command=bash scripts/reboot-recovery/install-reboot-auto-recovery-slo-110.sh --verify-only" in result.stdout
+    assert "would_include_source_gates=" in result.stdout
     assert "would_enable_timer=awoooi-reboot-auto-recovery-slo.timer" in result.stdout
 
 
@@ -55,6 +56,9 @@ def test_installer_is_limited_to_verifier_timer_not_product_restarts() -> None:
     assert "systemctl start ${UNIT_NAME}.service" in text
     assert 'payload_dir="$(mktemp -d "${TMPDIR:-/tmp}/${UNIT_NAME}.XXXXXX")"' in text
     assert 'payload="${payload_dir}/payload.tar.gz"' in text
+    assert "ops/maintenance" in text
+    assert "ops/monitoring" in text
+    assert "PUBLIC-MAINTENANCE-FALLBACK-RUNBOOK.md" in text
 
 
 def test_service_uses_deployed_source_root_and_bounded_oneshot() -> None: