fix(gateway): pin paired reconnect metadata for node policy

src/gateway/server.node-invoke-approval-bypass.test.ts

@@ -202,6 +202,7 @@ describe("node.invoke approval bypass", () => {
       readyResolve = resolve;
     });
 
+    const resolvedDeviceIdentity = deviceIdentity ?? createDeviceIdentity();
     const client = new GatewayClient({
       url: `ws://127.0.0.1:${port}`,
       // Keep challenge timeout realistic in tests; 0 maps to a 250ms timeout and can
@@ -215,7 +216,7 @@ describe("node.invoke approval bypass", () => {
       mode: GATEWAY_CLIENT_MODES.NODE,
       scopes: [],
       commands: ["system.run"],
-      deviceIdentity,
+      deviceIdentity: resolvedDeviceIdentity,
       onHelloOk: () => readyResolve?.(),
       onEvent: (evt) => {
         if (evt.event !== "node.invoke.request") {