fix(cd): allow bounded rollout convergence

apps/api/tests/test_executor_network_policy_boundary.py

@@ -224,6 +224,18 @@ def test_cd_concurrency_probe_degrades_to_terminal_false_receipt() -> None:
     assert "workload DB identity/budget remains in progress" in workflow
 
 
+def test_cd_allows_bounded_rollout_convergence_before_boundary_verifier() -> None:
+    repo_root = Path(__file__).resolve().parents[3]
+    workflow = (repo_root / ".gitea/workflows/cd.yaml").read_text()
+    rollout_gate = workflow.split("# Two-replica rollouts", 1)[1].split(
+        "# AIA-P0-011:", 1
+    )[0]
+
+    assert rollout_gate.count("--timeout=300s") == 4
+    assert "--timeout=120s" not in rollout_gate
+    assert "independent boundary verifier" in rollout_gate
+
+
 def test_broker_probe_accepts_partial_live_route_evidence(tmp_path: Path) -> None:
     result = _run_broker_probe(
         tmp_path,