fix(cd): isolate asset migration verifier network

.gitea/workflows/cd.yaml

@@ -1832,7 +1832,9 @@ jobs:
             echo "::error::MIGRATION_DATABASE_URL secret not set in Gitea"
             exit 1
           fi
-          docker run --rm --network host -i \
+          # The migration target is a routed LAN endpoint; the default bridge
+          # keeps the verifier compatible with the runner's userns-remap policy.
+          docker run --rm --network bridge -i \
             -e DATABASE_URL \
             -e MIGRATION_DATABASE_URL \
             -v "$PWD/apps/api/migrations/asset_inventory_database_types_2026-07-14.sql:/tmp/asset_inventory_type.sql:ro" \

apps/api/tests/test_asset_inventory_database_type_migration.py

@@ -58,6 +58,8 @@ def test_cd_applies_and_independently_verifies_the_bounded_migration() -> None:
     assert "MIGRATION_DATABASE_URL: ${{ secrets.MIGRATION_DATABASE_URL }}" in step
     assert "DATABASE_URL: ${{ secrets.DATABASE_URL }}" in step
     assert "${{ secrets." not in script
+    assert "--network bridge" in script
+    assert "--network host" not in script
     assert "asset_inventory_database_types_2026-07-14.sql" in script
     assert "asset_inventory_type_migration_applied=" in script
     assert "database_type_allowed=" in script