fix(cd): stabilize ready-pod SSH boundary probe

apps/api/tests/test_executor_network_policy_boundary.py

@@ -198,6 +198,28 @@ def test_cd_applies_rolls_back_and_verifies_network_boundary() -> None:
     assert "ssh-mcp-key known_hosts 更新失敗，停止部署" in workflow
 
 
+def test_cd_ssh_denial_probe_targets_ready_pod_and_classifies_transport() -> None:
+    repo_root = Path(__file__).resolve().parents[3]
+    workflow = (repo_root / ".gitea/workflows/cd.yaml").read_text()
+    probe = workflow.split("verify_ssh_denied() {", 1)[1].split(
+        "verify_broker_ssh_allowed() {", 1
+    )[0]
+
+    assert "for attempt in 1 2 3; do" in probe
+    assert "--field-selector=status.phase=Running" in probe
+    assert "--sort-by=.metadata.creationTimestamp" in probe
+    assert '--for=condition=Ready "$ready_pod_ref"' in probe
+    assert "status.containerStatuses" in probe
+    assert '$KUBECTL exec -i "$ready_pod_ref"' in probe
+    assert '$KUBECTL exec -i "deployment/$workload"' not in probe
+    assert "probe_status=$?" in probe
+    assert "grep -Eq '^unexpected_ssh_reachable=.+$'" in probe
+    assert 'last_failure="kubectl_exec_transport_failed"' in probe
+    assert "ssh_denial_probe_transport_unavailable" in probe
+    assert "API can still establish host SSH connections" not in workflow
+    assert "signal worker can still establish host SSH connections" not in workflow
+
+
 def test_cd_concurrency_probe_degrades_to_terminal_false_receipt() -> None:
     repo_root = Path(__file__).resolve().parents[3]
     workflow = (repo_root / ".gitea/workflows/cd.yaml").read_text()