fix(cd): bound non110 pressure threshold

.gitea/workflows/cd.yaml

@@ -45,6 +45,10 @@ env:
   # 2026-06-28 Codex: 110 runner pressure is an incident-grade capacity guard.
   # Do not flip this to warn-only until non-110 readiness is verified.
   HOST_WEB_BUILD_PRESSURE_WARN_ONLY: "0"
+  # 2026-06-30 Codex: CD is now pinned to the dedicated awoooi-non110-host lane.
+  # Keep the pressure guard fail-hard, but allow normal below-saturation load on
+  # that dedicated lane so P0 deploys are not stuck behind load5/core 0.85-1.05.
+  HOST_WEB_BUILD_PRESSURE_MAX_LOAD5_PER_CORE: "1.05"
   # Docker lock contention is also fail-hard during the same incident window.
   DOCKER_BUILD_LOCK_WARN_ONLY: "0"
   # 2026-05-24 Codex: deploy through the currently Ready control-plane node.

ops/runner/test_cd_controlled_runtime_profile.py

@@ -87,6 +87,16 @@ def test_harbor_login_has_public_route_retry_and_safe_secret_transport() -> None
     assert "--password " not in block
 
 
+def test_non110_cd_lane_keeps_pressure_guard_fail_hard_with_bounded_load_threshold() -> None:
+    text = _workflow_text()
+
+    assert 'HOST_WEB_BUILD_PRESSURE_WARN_ONLY: "0"' in text
+    assert 'HOST_WEB_BUILD_PRESSURE_MAX_LOAD5_PER_CORE: "1.05"' in text
+    assert "awoooi-non110-host" in text
+    assert 'HOST_WEB_BUILD_PRESSURE_WARN_ONLY: "1"' not in text
+    assert "warn-only" in text
+
+
 def test_harbor_watchdog_exposes_controlled_check_and_one_shot_repair() -> None:
     text = (ROOT / "scripts/reboot-recovery/harbor-watchdog.sh").read_text(
         encoding="utf-8"