feat(windows): add recoverable existing-agent credential upgrade

scripts/test-windows-agent-source.sh

@@ -4,7 +4,12 @@ set -euo pipefail
 service="agents/windows/MinerOpsAgentService.ps1"
 control="agents/windows/MinerOpsControl.ps1"
 installer="agents/windows/install.ps1"
+transition="agents/windows/Upgrade-MinerOpsAgentCredential.ps1"
+gui="agents/windows/MinerOpsAgentGUI.ps1"
 rg -q 'X-MinerOps-Agent-ID' "${service}"
+rg -q 'X-MinerOps-Agent-ID' "${gui}"
+rg -Fq '$config.agent_id' "${gui}"
+rg -q 'X-MinerOps-Agent-Secret' "${gui}"
 rg -Fq '$config.agent_zone_id' "${service}"
 rg -Fq '$body["agent_zone_id"]' "${service}"
 rg -q '"agent_zone_id"' agents/windows/config.example.json
@@ -28,9 +33,39 @@ rg -q 'could not restart restored MinerOpsAgent' "${installer}"
 ! rg -q 'Register-ScheduledTask.*-Force' "${installer}"
 ! rg -q 'agent_secret|api3_password|api3_account' "${installer}"
 
+rg -q 'existing_agent_credential_transition' "${transition}"
+rg -q '/api/agent/credential-transition' "${transition}"
+rg -q 'RandomNumberGenerator' "${transition}"
+rg -q 'agent-credential-transition.recovery.json' "${transition}"
+rg -q 'minerops-credential-transition\.blocked' "${transition}"
+rg -q 'Assert-MinerOpsTrustedAncestorNamespace' "${transition}"
+rg -q 'Open-MinerOpsDirectoryLock' "${transition}"
+rg -q 'Invoke-MinerOpsRecoverableConfigInstall' "${transition}"
+rg -q 'active-moved-to-prior' "${transition}"
+rg -q 'pending-moved-to-active' "${transition}"
+! rg -q '\[IO\.File\]::Replace|Invoke-MinerOpsAtomicConfigReplace' "${transition}"
+rg -q 'minerops-filesystem-trust\.blocked-' "${installer}"
+rg -q 'ApproveFilesystemTrustResetAfterReboot' "${installer}"
+rg -q 'windows-full-boot-event-v1:' "${installer}"
+rg -q 'windows-full-boot-event-v1:' "${transition}"
+! rg -q 'LastBootUpTime' "${installer}" "${transition}" \
+    agents/windows/Enroll-MinerOpsAgent.ps1
+! rg -q 'Remove-MinerOpsInstallerTrustBlocker' "${installer}"
+! rg -q 'Remove-MinerOpsEnrollmentTrustBlocker' \
+    agents/windows/Enroll-MinerOpsAgent.ps1
+rg -q 'Remove-MinerOpsFilesystemTrustBlockerAfterConvergence' "${transition}"
+rg -q 'GetNumberOfLinks' "${installer}"
+rg -q 'Assert-MinerOpsInstallerTrustedAncestors' "${installer}"
+! rg -q 'plexus-windows-agent|Plexus Mining Site' "${transition}"
+rg -q 'Get-MinerOpsVerifiedScheduledTask' "${transition}"
+! rg -q 'Get-ScheduledTask[^[:cntrl:]]*SilentlyContinue' "${transition}"
+
 if command -v pwsh >/dev/null 2>&1; then
     pwsh -NoProfile -File agents/windows/tests/Test-MinerOpsControl.ps1
     pwsh -NoProfile -File agents/windows/tests/Test-MinerOpsInstaller.ps1
+    pwsh -NoProfile -File agents/windows/tests/Test-MinerOpsBootEventParser.ps1
+    pwsh -NoProfile -File agents/windows/tests/Test-MinerOpsCredentialTransition.ps1
+    pwsh -NoProfile -File agents/windows/tests/Test-MinerOpsNativeHarness.ps1
 else
     echo "pwsh is not installed; deterministic PowerShell harnesses retained but not executed."
 fi