fix: fail closed on unapplied fault schedules

Author: chubes4

packages/cli/src/recipe-validation.ts

@@ -1170,6 +1170,9 @@ function validateRecipeAdversarialCampaigns(recipe: WorkspaceRecipe, recipePath:
     }
     const missing = (campaign.requiredCapabilities ?? []).filter((capability) => !available.has(capability))
     if (missing.length > 0) throw new Error(`Recipe adversarial campaign ${campaign.id} requires unavailable capabilities: ${missing.join(", ")}: ${recipePath}`)
+    if (campaign.faultSchedule && !(campaign.requiredCapabilities ?? []).includes("transport-faults")) {
+      throw new Error(`Recipe adversarial campaign ${campaign.id} faultSchedule requires the transport-faults capability: ${recipePath}`)
+    }
     if ((campaign.concurrency ?? 1) > 1 && !(campaign.requiredCapabilities ?? []).includes("isolated-workers")) {
       throw new Error(`Recipe adversarial campaign ${campaign.id} concurrency above 1 requires isolated-workers capability: ${recipePath}`)
     }

tests/adversarial-recipe-orchestration.test.ts

@@ -79,6 +79,10 @@ const unsupportedRecipe = structuredClone(recipe)
 unsupportedRecipe.adversarialCampaigns![0]!.requiredCapabilities = ["missing-adapter"]
 assert.throws(() => validateWorkspaceRecipeShape(unsupportedRecipe, "unsupported.json"), /requires unavailable capabilities: missing-adapter/)
 
+const unsafeFaultRecipe = structuredClone(recipe)
+unsafeFaultRecipe.adversarialCampaigns![0]!.faultSchedule = { schema: "wp-codebox/transport-fault-model/v1", seed: "faults", rules: [] }
+assert.throws(() => validateWorkspaceRecipeShape(unsafeFaultRecipe, "faults.json"), /faultSchedule requires the transport-faults capability/)
+
 const artifactRoot = await mkdtemp(join(tmpdir(), "wp-codebox-adversarial-recipe-"))
 try {
   const manifestPath = join(artifactRoot, "manifest.json")