production runtime and mock removal

scripts/check-ack-manifests.mjs

@@ -39,6 +39,7 @@ assert(goApi.includes("name: zhinian-go-runtime"), "Go API must consume the Go r
 assert(goApi.includes("name: zhinian-go-auth"), "Go API must own the browser session signing Secret");
 assert(!goApi.includes("name: zhinian-web-auth"), "Go API must not reference the removed Web auth Secret");
 assert(goApi.includes("name: zhinian-go-bootstrap"), "Go API must receive bootstrap administrator credentials");
+assert(goApi.includes("name: zhinian-go-providers"), "Go API must receive real provider credentials");
 assert(!goApi.includes("rds-ca"), "Go API must not mount an RDS CA when PostgreSQL TLS is disabled");
 assert(!goApi.includes("/etc/zhinian/rds"), "Go API must not retain the removed RDS CA path");
 assert(!/\bTLS\b/i.test(goApi), "Go API manifest must not retain PostgreSQL TLS configuration");
@@ -47,6 +48,7 @@ assert(!goApi.includes("DATABASE_CA_CERT_PATH"), "Go API must not receive a data
 
 const secrets = read("secrets.example.yaml");
 assert(secrets.includes("name: zhinian-go-auth"), "Example secrets must name Go as the session Secret owner");
+assert(secrets.includes("name: zhinian-go-providers"), "Example secrets must define real provider credentials");
 assert(!secrets.includes("name: zhinian-web-auth"), "Example secrets must not retain the removed Web auth Secret");
 assert(!secrets.includes("zhinian-rds-ca"), "Example secrets must not define the removed RDS CA Secret");
 assert(!secrets.includes("sslrootcert"), "Example DATABASE_URL values must not reference an RDS CA");