fix(cd): isolate Host111 trust migration

apps/api/tests/test_cd_known_hosts_recovery_gate.py

@@ -4,16 +4,21 @@ ROOT = Path(__file__).resolve().parents[3]
 WORKFLOW = ROOT / ".gitea/workflows/cd.yaml"
 
 
-def test_cd_known_hosts_gate_retries_and_verifies_preserved_secret() -> None:
+def test_cd_known_hosts_gate_keeps_core_fail_closed_and_host111_isolated() -> None:
     workflow = WORKFLOW.read_text(encoding="utf-8")
     gate = workflow[workflow.index(": > /tmp/known_hosts_repair") :]
     gate = gate[: gate.index('echo "✅ 所有 Secrets 注入完成"')]
 
     assert "for scan_attempt in 1 2 3" in gate
     assert 'sleep "\\$scan_attempt"' in gate
-    assert "existing ssh-mcp-key verified 6/6 and preserved" in gate
-    assert "EXISTING_PRESENT=\\$((EXISTING_PRESENT + 1))" in gate
-    assert 'if [ "\\$EXISTING_PRESENT" -eq "\\$EXPECTED_HOSTS" ]' in gate
+    assert "CORE_EXPECTED_HOSTS=5" in gate
+    assert "TARGET_HOSTS=6" in gate
+    assert "fresh_6_of_6" in gate
+    assert "preserve_existing_6_of_6" in gate
+    assert "fresh_core_5_host111_trust_deferred" in gate
+    assert "preserve_existing_core_5_host111_trust_deferred" in gate
+    assert "host-key core trust incomplete" in gate
+    assert "host111_trust_deferred isolated_lane=ansible:111-ollama-fallback" in gate
     assert 'rm -f "\\$EXISTING_KNOWN_HOSTS"' in gate
     assert "cat /tmp/known_hosts_scan_err" not in gate
-    assert "existing ssh-mcp-key coverage" in gate
+    assert "KNOWN_HOSTS_B64=\\$(base64 -w 0 \"\\$TRUST_SOURCE\")" in gate

apps/api/tests/test_executor_network_policy_boundary.py

@@ -192,8 +192,12 @@ def test_cd_applies_rolls_back_and_verifies_network_boundary() -> None:
         "192.168.0.121 192.168.0.188"
     )
     assert f"ssh-keyscan -T 5 {expected_known_hosts}" in workflow
-    assert "EXPECTED_HOSTS=6" in workflow
-    assert workflow.count(expected_known_hosts) >= 4
+    assert "CORE_EXPECTED_HOSTS=5" in workflow
+    assert "TARGET_HOSTS=6" in workflow
+    assert "fresh_core_5_host111_trust_deferred" in workflow
+    assert "preserve_existing_core_5_host111_trust_deferred" in workflow
+    assert "host111_trust_deferred isolated_lane=ansible:111-ollama-fallback" in workflow
+    assert workflow.count(expected_known_hosts) >= 2
     assert workflow.count(expected_hosts) >= 2
     assert "except ConnectionRefusedError:" in workflow
     assert "broker_ssh_refused_but_egress_permitted=" in workflow