Merge remote-tracking branch 'origin/main' into codex/ai-automation-codebase-review-20260710

# Conflicts:
#	.gitea/workflows/cd.yaml
#	apps/api/tests/test_executor_network_policy_boundary.py

apps/api/tests/test_executor_network_policy_boundary.py

@@ -70,10 +70,13 @@ def test_cd_applies_rolls_back_and_verifies_network_boundary() -> None:
 
     assert "02-network-policy.yaml" in workflow
     assert "NETWORK_POLICY_ROLLBACK_FILE" in workflow
-    assert "get networkpolicy -n awoooi-prod -o json" in workflow
+    assert "get networkpolicy ${NETWORK_POLICY_NAMES[*]}" in workflow
     assert "rollback_network_policy_on_exit" in workflow
     assert "git show HEAD^:k8s/awoooi-prod/02-network-policy.yaml" not in workflow
     assert "BROKER_POLICY_EXISTED" in workflow
+    assert "NETWORK_POLICY_NAMES" in workflow
+    assert "item[\"metadata\"][\"name\"]" in workflow
+    assert "item[\"spec\"]" in workflow
     assert "$KUBECTL delete networkpolicy '$BROKER_POLICY_NAME'" in workflow
     assert "auth_can_i()" in workflow
     assert "API_CAN_PATCH=$(auth_can_i" in workflow