test(e2e): assert stable replay contracts

Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>

e2e/python/test_sandbox_api.py

@@ -64,7 +64,13 @@ def test_mutation_replay_preserves_sandbox_lifecycle_and_replacement(
             request_id=str(uuid.uuid4()),
         )
         updated = stub.UpdateConfig(update, timeout=30)
-        assert replay(stub.UpdateConfig, update) == updated
+        replayed_update = replay(stub.UpdateConfig, update)
+        assert replayed_update.version == updated.version
+        assert replayed_update.policy_hash == updated.policy_hash
+        assert replayed_update.settings_revision == updated.settings_revision
+        assert replayed_update.deleted == updated.deleted
+        assert replayed_update.annotations == updated.annotations
+        assert replayed_update.operation.operation_id == updated.operation.operation_id
         delete = openshell_pb2.DeleteSandboxRequest(
             name=name,
             workspace_scope=datamodel_pb2.WorkspaceSelector(workspace=scope),

e2e/rust/tests/policy_activation.rs

@@ -317,11 +317,11 @@ binaries:
         String::from_utf8_lossy(&logs.stderr)
     );
     assert_eq!(
-        logs.matches("credentialed endpoint 'api.example.com:443'")
-            .count(),
+        logs.matches("OCSF CONFIG:FAIL_CLOSED").count(),
         1,
         "unchanged startup rejection must be logged only once: {logs}"
     );
+    assert!(logs.contains("credentialed endpoint 'api.example.com:443'"));
     assert!(!logs.contains("Creating OPA engine from proto policy data"));
     let repaired = context.path().join("repaired.yaml");
     std::fs::write(