Account for runtime RCON passwords in config drift

tests/unit/beta-promotion.test.ts

@@ -49,15 +49,23 @@ describe('reviewed beta promotion', () => {
         const { betaId } = await ready(kind);
         const { prepareNativeHost } = await import('../helpers/native-host.js');
         await prepareNativeHost([servers[1]]);
+        const { db } = await import('../../src/lib/server/db/index.js');
+        db().prepare(`INSERT INTO ec_host_operations(id,host_id,instance_id,generation,kind,payload,state,created_at,updated_at)
+            SELECT 'launch',host_id,id,generation,'instance.create',?,'completed',created_at,created_at
+            FROM native_instances WHERE server=?`).run(JSON.stringify({ rconPassword: 'assigned-password' }), servers[1]);
         const native = await import('../../src/lib/server/backends/native.js');
         const request = vi.spyOn(native, 'nativeRequest').mockRejectedValue(new Error('Agent unavailable'));
         const { previewBetaPromotion, promoteBeta } = await import('../../src/lib/server/fleet/beta.js');
         const result = await promoteBeta(betaId, previewBetaPromotion(betaId).token);
         expect(result.awaitingActivation).toBe(1);
         expect(request).not.toHaveBeenCalled();
-        const { db } = await import('../../src/lib/server/db/index.js');
         expect(db().prepare('SELECT snapshot_pending FROM deployment_files WHERE deployment_id = ? AND server = ?')
             .get(result.deploymentId, servers[1])).toEqual({ snapshot_pending: 1 });
+        if (kind === 'baseline') {
+            const staged = db().prepare(`SELECT b.content FROM staged_file_changes f JOIN file_blobs b ON b.sha256=f.content_hash
+                WHERE f.source_kind='campaign' AND f.source_id=? AND f.server=?`).get(result.deploymentId, servers[1]) as { content: Buffer };
+            expect(staged.content.toString()).toContain('set rcon_password "assigned-password"');
+        }
     });
 
     it.each([