fix(cd): keep recovery evidence on controlled profile

docs/LOGBOOK.md

@@ -50365,3 +50365,18 @@ production browser smoke:
 **下一步**：
 - 先恢復 110 SSH read-only command path，才能驗證 Stock DB/schema、Gitea dump、110 backup completeness。
 - 將 188 Gitea subtree backup metric 部署到 runtime textfile exporter 後，確認 `awoooi_backup_coverage_domain_fresh{host="188",domain="service"}` 能在 Gitea 子樹空目錄時告警。
+
+## 2026-06-30 — 19:35 P0 recovery evidence CD controlled-runtime profile 修復
+
+**完成內容**：
+- 公開 Gitea readback 顯示 `#4035` / `4e909b211` 失敗，jobs log 不公開且 token required；未讀 secret、未用 Gitea API write、未 workflow_dispatch。
+- 定位可復現 source-side 風險：`docs/runbooks/REBOOT-POST-START-QUICK-CHECK.md`、reboot workplan、`ops/monitoring/alerts-unified.yml`、`scripts/ops/backup-health-textfile-exporter.py`、`scripts/reboot-recovery/tests/test_reboot_p0_operational_contract.py` 未列入 CD `controlled-runtime` whitelist，會讓 P0 recovery evidence 變更落入 full/B5 路徑。
+- 修正 `.gitea/workflows/cd.yaml`：上述 P0 recovery evidence / alert / exporter / contract test 改走 controlled-runtime；窄 profile 補 `alerts-unified.yml` YAML parse、backup exporter `py_compile`、reboot operational contract pytest。
+- 更新 `ops/runner/test_cd_controlled_runtime_profile.py`，鎖住這批路徑與 verifier，避免同類 P0 recovery evidence 再誤進 full/B5。
+
+**本地驗證結果**：
+- rebase 到 `c6c90e72f fix(api): redact autonomous runtime public payload terms` 後，`DATABASE_URL=postgresql+asyncpg://test:test@localhost:5432/test PYTHONPATH=apps/api python3.11 -m pytest ... -q`：`72 passed`。
+- `ruff check`、`py_compile`、`alerts-unified.yml` YAML parse、`guard-gitea-runner-pressure.py`、`check-gitea-step-env-secrets.js`、`git diff --check`：通過。
+
+**下一步**：
+- commit/push 後等待新的 Gitea CD run；deploy marker 更新後讀回 `delivery-closure-workbench`、`awoooi-priority-work-order-readback`、`stockplatform-public-api-controlled-recovery-preflight`。