feat(ci): enable warning step runtime switch

docs/LOGBOOK.md

@@ -12,6 +12,20 @@
 
 **邊界**：未重啟主機，未 restart service，未 workflow_dispatch，未操作 host / Docker / K8s / DB / firewall，未使用 GitHub / `gh` / GitHub API，未讀 secret / token / raw sessions / SQLite / `.env`。
 
+## 2026-06-30 — 01:25 P0-004 warning-step runtime switch controlled apply
+
+**照優先順序完成的實作**：
+- production 已讀回 `/api/v1/agents/awoooi-gitea-onboarding-warning-step-runtime-enablement-gate` 為 `controlled_warning_step_runtime_enablement_gate_ready`，因此推進 P0-004 下一段 controlled apply。
+- 將 `.gitea/workflows/awoooi-onboarding-warning-step.yaml` 與 source template 的 `AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED` 從 `"0"` 改為 `"1"`；workflow 仍只允許 `workflow_dispatch`，runner 仍是 `awoooi-non110-host`，沒有新增 push / pull_request / pull_request_target。
+- 更新 template-copy receipt hash 與 runtime switch readback，runtime gate 現在本地讀回 `controlled_warning_step_runtime_enabled`、`runtime_switch_changed=true`、`workflow_trigger_performed=false`，Delivery Workbench 同步投影 enabled 狀態。
+
+**驗證**：
+- `py_compile`、ruff focused check、P0-004 / Delivery Workbench / CD profile focused pytest `37 passed`。
+- Gitea runner pressure guard：`auto_branch_events_on_110=0`、`generic_runner_labels=0`。
+- Local readback：receipt ready、switch value `1`、gate active blockers `[]`、controlled apply already consumed、workflow dispatch performed `false`。
+
+**邊界**：未 workflow_dispatch，未改 runner，未操作 host / Docker / K8s / DB / firewall，未使用 GitHub / `gh` / GitHub API，未讀 secret / token / raw sessions / SQLite / `.env`。
+
 ## 2026-06-30 — 00:41 P0-004 template copy receipt runtime-image readback 修正
 
 **照優先順序完成的實作**：

docs/operations/awoooi-gitea-onboarding-warning-step-template-copy-receipt.snapshot.json

@@ -1,16 +1,19 @@
 {
   "schema_version": "awoooi_gitea_onboarding_warning_step_template_copy_receipt_snapshot_v1",
-  "generated_at": "2026-06-30T00:42:00+08:00",
+  "generated_at": "2026-06-30T01:27:00+08:00",
   "workplan_id": "P0-004-TEMPLATE-COPY-CONTROLLED-APPLY",
   "source_template_path": "docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml",
   "destination_workflow_path": ".gitea/workflows/awoooi-onboarding-warning-step.yaml",
-  "source_template_content_sha256_12": "70ecac9e4b59",
-  "destination_workflow_content_sha256_12": "70ecac9e4b59",
+  "source_template_content_sha256_12": "23b59f29cb77",
+  "destination_workflow_content_sha256_12": "23b59f29cb77",
   "template_copy_recorded": true,
   "destination_workflow_runtime_visible_required": false,
   "runtime_image_excludes_dot_gitea": true,
   "workflow_dispatch_declared": true,
-  "fail_closed_execution_switch_present": true,
+  "fail_closed_execution_switch_present": false,
+  "runtime_execution_switch_controlled": true,
+  "runtime_execution_switch_value": "1",
+  "runtime_enablement_switch_changed": true,
   "workflow_trigger_performed": false,
   "auto_branch_event_count": 0,
   "generic_runner_label_count": 0,

docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml

@@ -1,9 +1,9 @@
 # AWOOOI Gitea Onboarding Warning Step template.
 #
-# Controlled-copy default:
+# Controlled-runtime default:
 # - no push / pull_request / pull_request_target trigger
 # - no generic runner labels
-# - runtime warning-step job is disabled until a separate controlled gate changes the switch
+# - runtime warning-step job is enabled only for manual workflow_dispatch
 # - no secrets, host writes, workflow dispatch from Codex, or runtime apply
 
 name: AWOOOI Onboarding Warning Step
@@ -12,18 +12,18 @@ on:
   workflow_dispatch:
 
 env:
-  AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED: "0"
+  AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED: "1"
 
 jobs:
   workflow-shape:
     # Gitea 1.25 can mark a workflow invalid when every root job has a job-level
     # `if`. Keep this no-op root job so the template remains parseable while
-    # the runtime warning-step job below stays fail-closed.
+    # the runtime warning-step job below is gated by the explicit env switch.
     runs-on: awoooi-non110-host
     timeout-minutes: 1
     steps:
       - name: Confirm fail-closed warning-step workflow shape
-        run: echo "warning-step runtime job remains disabled by default."
+        run: echo "warning-step runtime job is enabled for manual dispatch only."
 
   warning-step:
     if: ${{ env.AWOOOI_ONBOARDING_WARNING_STEP_EXECUTION_ENABLED == '1' }}
@@ -39,5 +39,5 @@ jobs:
           git diff --check
           cat <<'SUMMARY'
           AWOOOI onboarding warning step template is present.
-          Runtime execution remains disabled until the next controlled gate.
+          Runtime execution is enabled only for manual workflow_dispatch.
           SUMMARY