fix(cd): keep cold-start recovery checks on controlled profile

ops/runner/test_cd_controlled_runtime_profile.py

@@ -91,6 +91,7 @@ def test_workflow_secret_transport_sources_stay_on_controlled_runtime_profile()
         ".gitea/workflows/code-review.yaml)",
         ".gitea/workflows/deploy-alerts.yaml)",
         ".gitea/workflows/e2e-health.yaml)",
+        ".gitea/workflows/ansible-lint.yml)",
         ".gitea/workflows/harbor-110-local-repair.yaml)",
         ".gitea/workflows/run-migration.yml)",
         "scripts/ci/check-gitea-step-env-secrets.js)",
@@ -659,6 +660,7 @@ def test_post_start_recovery_verifiers_stay_on_controlled_runtime_profile() -> N
     text = _workflow_text()
     expected_sources = [
         "docs/runbooks/REBOOT-POST-START-QUICK-CHECK.md)",
+        "docs/runbooks/FULL-STACK-COLD-START-SOP.md)",
         "docs/workplans/2026-06-04-reboot-cold-start-backup-recovery-workplan.md)",
         "ops/monitoring/alerts-unified.yml)",
         "ops/runner/awoooi-cd-lane-drain.service)",
@@ -669,6 +671,7 @@ def test_post_start_recovery_verifiers_stay_on_controlled_runtime_profile() -> N
         "scripts/reboot-recovery/deploy-to-110.sh)",
         "scripts/reboot-recovery/recover-110-control-path-and-harbor-local.sh)",
         "scripts/reboot-recovery/post-start-quick-check.sh)",
+        "scripts/reboot-recovery/reboot-recovery-readiness-audit.sh)",
         "scripts/reboot-recovery/188-host-hygiene-maintenance-checklist.sh)",
         "scripts/reboot-recovery/full-stack-cold-start-check.sh)",
         "scripts/reboot-recovery/full-stack-recovery-scorecard.sh)",