Keep Coroot consumer tests bound to the deployed parser #4934

🤖 Generated by the Agentic Engineer

Description

The Coroot consumer regression introduced by #4920 uses a test-only logparser dependency to represent the deployed node-agent. Independent dependency automation can update that witness without updating the deployed producer. PR #4926 proposes v1.4.2 while the recorded node-agent source ee62018e73b9 still requires v1.4.0. The existing suite passes but no longer establishes the deployed-consumer claim.

Steps to Reproduce

1. Compare the pinned node-agent source go.mod with the platform test dependency.
2. Inspect fix(deps): update module github.com/coroot/logparser to v1.4.2 #4926: only go.mod and go.sum advance the witness to v1.4.2.
3. Observe green checks without a deployment/source-binding assertion.

Expected Behavior

Consumer evidence must stay bound to the actual deployed parser. An independently newer reference library must not silently count as deployed-agent compatibility. Legitimate parser updates need a reviewed corresponding source update, without disabling severity or dependency checks.

Acceptance Criteria

• Preserve the current verified parser witness and stop the unsupported standalone update.
• Add a regression that rejects a parser/source mismatch before reporting deployed-consumer coverage.
• Keep dependency updates visible and make the required paired update explicit.
• Prove RED/GREEN, current-head review, CI and merge without changing production severity or suppressing errors.

Part of #2043. Priority High; Effort Low; Standard service class. This is an evidence-correctness defect, not proof of a production parser incident.

Accepted after merge in PR #4935. Merge-group CI 38816764494 passed; the production deploy was correctly skipped. This is an offline witness guard, not live clearance. The separate local full-suite cleanup failure remains tracked in #4936.