test(wp7-02): require stable model secure routing

tests/package/wp7-02-external-contract.test.mjs

@@ -8,6 +8,7 @@ import {
   buildBlockedModelEvidence,
   buildModelContractPlan,
   inspectAiGatewayReadiness,
+  productModelIdForControlledState,
   validateCandidateDependency,
   validateIndependentEvidenceSet,
 } from "../../scripts/lib/wp7-02-external-contract.mjs";
@@ -31,6 +32,9 @@ test("TDD-WP7-EXT-001 fixes the user-approved replacement model set", () => {
     "gemini-3.1-flash-image",
     "gpt-image-2",
   ]);
+  assert.equal(productModelIdForControlledState("gemini-3.1-flash-image"), "gemini-3.1-flash-image-preview");
+  assert.equal(productModelIdForControlledState("gpt-image-2"), "gpt-image-2");
+  assert.throws(() => productModelIdForControlledState("gemini-3-pro-image-preview"), /WP7_02_MODEL_NOT_ALLOWED/);
   for (const modelId of WP7_02_MODEL_IDS) {
     const plan = buildModelContractPlan(modelId);
     assert.equal(plan.model_id, modelId);