Test k8shost restart-safe controller cleanup

nix/test-cluster/run-cluster.sh

@@ -3789,6 +3789,30 @@ validate_k8shost_flow() {
   log "Matrix case: K8sHost + FiberLB"
   wait_for_http node01 "http://127.0.0.1:${service_port}/health"
 
+  log "Restarting K8sHost and verifying restart-safe controller reconciliation"
+  ssh_node node01 "systemctl restart k8shost.service"
+  wait_for_unit node01 k8shost
+  wait_for_http node01 "http://127.0.0.1:8085/health"
+
+  deadline=$((SECONDS + HTTP_WAIT_TIMEOUT))
+  while true; do
+    service_json="$(grpcurl -plaintext \
+      -H "authorization: Bearer ${token}" \
+      -import-path "${K8SHOST_PROTO_DIR}" \
+      -proto "${K8SHOST_PROTO}" \
+      -d "$(jq -cn --arg ns "default" --arg name "${service_name}" '{namespace:$ns, name:$name}')" \
+      127.0.0.1:15087 k8shost.ServiceService/GetService 2>/dev/null || true)"
+    if [[ -n "${service_json}" ]] && printf '%s' "${service_json}" | jq -e --arg lb "${lb_id}" --arg record "${record_id}" '
+      .service.metadata.annotations["fiberlb.plasmacloud.io/lb-id"] == $lb and
+      .service.metadata.annotations["flashdns.plasmacloud.io/record-id"] == $record' >/dev/null 2>&1; then
+      break
+    fi
+    if (( SECONDS >= deadline )); then
+      die "timed out waiting for K8sHost service ${service_name} to recover published state after restart"
+    fi
+    sleep 2
+  done
+
   grpcurl -plaintext \
     -H "authorization: Bearer ${token}" \
     -import-path "${K8SHOST_PROTO_DIR}" \