fix(cd): keep windows vmware verifier on controlled profile

.gitea/workflows/cd.yaml

@@ -665,6 +665,8 @@ jobs:
                 ;;
               scripts/reboot-recovery/reboot-auto-recovery-slo-scorecard.py)
                 ;;
+              scripts/reboot-recovery/windows99-vmware-autostart.ps1)
+                ;;
               scripts/reboot-recovery/tests/test_reboot_auto_recovery_slo_installer.py)
                 ;;
               scripts/reboot-recovery/tests/test_reboot_auto_recovery_slo_scorecard.py)

docs/LOGBOOK.md

@@ -1,3 +1,20 @@
+## 2026-07-02 — 14:46 CD controlled-runtime classifier 補上 Windows 99 VMware verifier source
+
+**完成內容**：
+- Gitea CD `#4392` 讀回：commit `8e2637f1 fix(reboot): surface windows99 vmware verifier gap` 的 tests job 進入 `B5 effective test profile=full`，因 non-110 runner 內 `BLOCKER b5_docker_socket_unavailable` 失敗。
+- 根因是新加入的 `scripts/reboot-recovery/windows99-vmware-autostart.ps1` 未列入 `.gitea/workflows/cd.yaml` controlled-runtime path classifier；同筆提交其他 P0 reboot scorecard/API/test/runbook/snapshot path 已在 allowlist。
+- 已補 `.gitea/workflows/cd.yaml` 與 `ops/runner/test_cd_controlled_runtime_profile.py` regression，讓 Windows 99 VMware autostart verifier source 留在 controlled-runtime，不再誤觸 B5 Docker socket 路徑。
+
+**驗證**：
+- `python3.11 -m pytest ops/runner/test_cd_controlled_runtime_profile.py -q`：`44 passed`。
+- `python3.11 -c "import yaml; yaml.safe_load(open('.gitea/workflows/cd.yaml'))"`：通過。
+- P0 reboot focused tests：`39 passed`。
+- rebase 最新 Gitea `main`（到 `0f5d5d69 fix(web): restore work item spotlight english copy`）後，web message JSON parse 與 `pnpm --dir apps/web exec tsc --noEmit --incremental false`：通過。
+- `git diff --check`：通過。
+
+**仍維持**：
+- 未觸發 workflow_dispatch；未重啟 runner、Docker、主機、K3s 或 DB；未讀 secret / token / `.env` / raw sessions / SQLite / auth；未使用 GitHub / `gh` / GitHub API。
+
 ## 2026-07-02 — 14:28 P0-006 service / data / backup controlled readback 產品化
 
 **完成內容**：

ops/runner/test_cd_controlled_runtime_profile.py

@@ -740,6 +740,7 @@ def test_reboot_auto_recovery_slo_sources_stay_on_controlled_runtime_profile() -
         "scripts/reboot-recovery/reboot-auto-recovery-host-probe.sh)",
         "scripts/reboot-recovery/reboot-auto-recovery-slo-exporter.sh)",
         "scripts/reboot-recovery/reboot-auto-recovery-slo-scorecard.py)",
+        "scripts/reboot-recovery/windows99-vmware-autostart.ps1)",
         "scripts/reboot-recovery/full-stack-cold-start-check.sh)",
         "scripts/reboot-recovery/full-stack-recovery-scorecard.sh)",
         "scripts/reboot-recovery/harbor-watchdog.sh)",
@@ -802,6 +803,7 @@ def test_post_start_recovery_verifiers_stay_on_controlled_runtime_profile() -> N
         "scripts/reboot-recovery/full-stack-recovery-scorecard.sh)",
         "scripts/reboot-recovery/awoooi-startup-110.sh)",
         "scripts/reboot-recovery/harbor-watchdog.sh)",
+        "scripts/reboot-recovery/windows99-vmware-autostart.ps1)",
         "scripts/reboot-recovery/apply-credential-escrow-closeout-receipt-to-110.sh)",
         "scripts/reboot-recovery/verify-cold-start-monitor-deploy.sh)",
         "scripts/reboot-recovery/tests/test_188_host_hygiene_checklist.py)",