test(usage): align source disclosure notice version

[Duang777]

Summary

• update the source CLI disclosure assertion to the notice version introduced by feat(telemetry): qualify usage diagnostics and installation return cohorts #5366
• keep the test as an observable literal-value check, matching the existing usage-ping coverage

Regression evidence

On clean origin/main@9c9b90d8e, the focused test deterministically failed with:

assert stored["notice"]["version"] == 4
E assert 5 == 4

The same assertion failed in #5375 test-shard (3). The production owner and the surrounding usage tests already require version 5; this is the only stale version-4 assertion.

Validation

• tests/control_plane/test_source_cli_entrypoint.py: 40 passed
• tests/test_usage_ping.py: 34 passed
• Ruff: passed
• git diff --check: passed
• Bits Code Guard: 0 P0-P2 findings

This PR does not modify production behavior and was not merged by the author.

[Duang777]

Exact-head CI update for 85b87e9901adf3fd67d8e1f1ed9a1d4059943820: the usage-notice assertion changed by this PR no longer fails. The remaining failures are inherited from current main or covered by parallel fixes: typescript-core (1/3) is the duplicate digest-owner matcher fixed by #5377, while test-shard (2), (3), and (4) are the packaged-runtime source-churn race fixed by #5367. The aggregate checks, pytest, and expected merge-gate result are downstream of those shard failures. No #5379 code change is needed.

@cocolord @huangruiteng please review this exact head when available. No merge action was taken.

[huangruiteng]

动机

#5366 已把扩展后的 usage disclosure 契约升级到版本5，当前不可变 base 的 TypeScript owner、Python 适配器和 docs/reference/usage-ping.md:330 都已明确5。现有 source CLI 测试却仍要求4，导致真实首次告知路径出现5==4的误报。本 PR 完整解决这个测试期望缺口，不改变遥测行为。

改动思路

在已有集成测试中保留独立的契约断言，只把旧版本4改为接受的版本5。没有从实现常量自动导出期望，也没有放松 JSON、首次不发送、无 attempt／counter 等隐私断言。无需新 helper、smoke 或生产版本变更。

具体改动

仅 tests/control_plane/test_source_cli_entrypoint.py:314 一行替换。test_source_first_usage_disclosure_keeps_json_pure_and_does_not_send 仍通过 runpy 执行真实 loopx.cli 模块和 canonical entrypoint，读取实际 TypeScript 写入的本机 notice state；sender 的观察桩防止首次发送，并非提供 notice5 的桩。没有新增源码、协议、权限、配置、collector 或 UI 改动。

对主干的风险

我在不可变 base 9c9b90d 执行原生单例，实际走到 stored.notice.version=5，再因旧期望4失败；这不是继承作者报告。exact head 85b87e9 的 source entrypoint 与 usage-ping 两组测试共74passed。仍检查 JSON stdout、stderr告知、首次不发送、无 last_attempt_day／counters，以及 usage opt-out 无本机状态／sender；相关 native suite 还覆盖缺失／损坏 stderr、consent-required、真实本地 collector 和 disable 后不再发送。Ruff、DCO、diff hygiene 通过。

版本5的 oracle 来自已接受的合入变更和当前规范，不是“当前输出是什么就改成什么”。最强反例是首次偷偷发送但版本正确：未改的 no-send 断言仍会失败。首告知测试的 sender 边界被阻止／观察，其余实际本地状态和 source CLI 路径执行；不将其称为部署后的 collector／frontend验证。

现有 coverage 搜索包括 source entrypoint、Python usage 和 TypeScript usage suites；同作者近期 PR 批次也做了有界扫描。本 PR 没新建重复 smoke，仅恢复已有用户入口 guard 的信号。没有改变生产默认值、状态分类或 machine obligation，不需要 frontend/Lark companion。首次猜错不存在测试路径导致收集前退出，已用实际文件重跑；它不是 PR 缺陷。未执行全仓／原生其他 OS／安装激活，未查询或等待远端 CI。

我的整体评价

APPROVE，适用于 85b87e9。没有发现阻断问题。长期维护改善：正确贡献不再被旧版本误报，隐私断言仍保留；产品用户体验及权限边界保持不变。未来演进检查建议保持这种独立契约 oracle，不把硬编码5换成直接引用实现常量；现有单行维护已是合适边界，无需新抽象或跟踪任务。本批不合并，也不把该测试修复等同于遥测发布／部署完成。

English verdict: APPROVE - 85b87e9: align the existing source-entrypoint assertion with the accepted notice5 contract; the obsolete base failure was reproduced and74native tests passed without weakening privacy checks.

[Duang777]

Synced with main@f49b4a00870604d39fa4318da24d6dd35e72bb6e using signed merge commit 5fa910d892333b32a0cd1cc87d105984a7c01bc8. The merge was conflict-free, and the PR diff remains limited to tests/control_plane/test_source_cli_entrypoint.py.

Focused validation on the new exact head: tests/control_plane/test_source_cli_entrypoint.py passed all 40 tests. The branch was pushed normally without history rewriting. CI has restarted; no merge action was taken.