fix(ci): keep workflow guard changes on narrow cd profile

ops/runner/test_cd_controlled_runtime_profile.py

@@ -35,6 +35,21 @@ def test_deploy_marker_k8s_files_stay_on_controlled_runtime_profile() -> None:
     assert "k8s/awoooi-prod/kustomization.yaml)" in text
 
 
+def test_workflow_secret_transport_sources_stay_on_controlled_runtime_profile() -> None:
+    text = _workflow_text()
+    assert "workflow secret-transport and guard-only" in text
+    expected_sources = [
+        ".gitea/workflows/cd-dev.yaml)",
+        ".gitea/workflows/code-review.yaml)",
+        ".gitea/workflows/deploy-alerts.yaml)",
+        ".gitea/workflows/e2e-health.yaml)",
+        ".gitea/workflows/run-migration.yml)",
+        "scripts/ci/check-gitea-step-env-secrets.js)",
+    ]
+    for source in expected_sources:
+        assert source in text
+
+
 def test_onboarding_warning_step_template_stays_on_controlled_runtime_profile() -> None:
     text = _workflow_text()
     assert "onboarding warning-step workflow is" in text