fix(cd): align verifier with nullpool budget

apps/api/tests/test_executor_trust_boundary_readback.py

@@ -384,8 +384,8 @@ def test_executor_trust_boundary_requires_api_null_pool_concurrency_cap() -> Non
 
 def test_executor_trust_boundary_does_not_double_count_used_budget() -> None:
     receipt = _verified_receipt()
-    receipt["worker_active_role_connection_count"] = "3"
-    receipt["worker_available_connection_headroom"] = "5"
+    receipt["worker_active_role_connection_count"] = "7"
+    receipt["worker_available_connection_headroom"] = "1"
 
     readback = build_executor_trust_boundary_readback(
         receipt,
@@ -400,6 +400,24 @@ def test_executor_trust_boundary_does_not_double_count_used_budget() -> None:
     )
 
 
+def test_executor_trust_boundary_requires_representative_probe_headroom() -> None:
+    receipt = _verified_receipt()
+    receipt["worker_active_role_connection_count"] = "8"
+    receipt["worker_available_connection_headroom"] = "0"
+
+    readback = build_executor_trust_boundary_readback(
+        receipt,
+        deployed_source_sha="abc123",
+    )
+
+    database_boundary = readback["database_identity_boundary"]
+    assert readback["full_workload_boundary_verified"] is False
+    assert database_boundary["connection_budget_verified"] is False
+    assert "worker_connection_budget_not_verified" in (
+        database_boundary["active_blockers"]
+    )
+
+
 def test_executor_trust_boundary_binds_budget_and_verifier_contract() -> None:
     wrong_budget = _verified_receipt()
     wrong_budget["worker_required_connection_budget"] = "4"