fix(ci): isolate runtime image controller tests

.gitea/workflows/cd.yaml

@@ -840,6 +840,16 @@ jobs:
                 ;;
               scripts/security/gitea-authenticated-inventory-payload-validator.py)
                 ;;
+              # Runtime image mirror changes are exercised by the focused
+              # controller suite below and do not touch the API database.
+              config/security/runtime-image-mirror-policy.json)
+                ;;
+              config/security/runtime-image-mirror-staging-policy.json)
+                ;;
+              scripts/security/runtime_image_mirror_controller.py)
+                ;;
+              scripts/security/tests/test_runtime_image_mirror_controller.py)
+                ;;
               scripts/security/security-mirror-progress-guard.py)
                 ;;
               scripts/security/telegram-notification-egress-no-new-bypass-guard.py)

apps/api/tests/test_cs1_auto_execute.py

@@ -131,6 +131,8 @@ async def test_webhook_router_writes_queue_receipt_without_side_effect(
             "dispatchReceipt": {
                 "accepted": True,
                 "inbox_triggered": True,
+                "queue_accepted": True,
+                "dispatch_identity_matched": True,
             },
             "correlatedReceipt": {"receipt_persisted": True},
         }

ops/runner/test_cd_controlled_runtime_profile.py

@@ -1149,6 +1149,21 @@ def test_b5_full_profile_uses_outer_docker_for_db_without_inner_socket_mount() -
     )
 
 
+def test_runtime_image_mirror_sources_stay_on_controlled_runtime_profile() -> None:
+    text = _workflow_text()
+    expected_sources = [
+        "config/security/runtime-image-mirror-policy.json)",
+        "config/security/runtime-image-mirror-staging-policy.json)",
+        "scripts/security/runtime_image_mirror_controller.py)",
+        "scripts/security/tests/test_runtime_image_mirror_controller.py)",
+    ]
+    for source in expected_sources:
+        assert source in text
+
+    assert "../../scripts/security/runtime_image_mirror_controller.py" in text
+    assert "../../scripts/security/tests/test_runtime_image_mirror_controller.py" in text
+
+
 def test_controlled_runtime_pytest_paths_exist() -> None:
     text = _workflow_text()
     block = text.split("PYTHONFAULTHANDLER=1 python3.11 -m pytest", 1)[1]