fix: fail closed backend capabilities and isolate gate smoke

tests/workflow-config.test.ts

@@ -5,14 +5,17 @@ const workflow = readFileSync('.gitea/workflows/ci.yml', 'utf8');
 const compose = readFileSync('compose.yaml', 'utf8');
 const dockerfile = readFileSync('Dockerfile', 'utf8');
 const dockerignore = readFileSync('.dockerignore', 'utf8');
+const convexConfig = readFileSync('scripts/configure-convex.ts', 'utf8');
 
-test('Gitea workflow separates PR source checks from trusted container builds', () => {
+test('Gitea workflow keeps source checks separate and holds unverified container CI', () => {
   expect(workflow).toContain('pull_request:');
-  expect(workflow).toContain("if: ${{ gitea.event_name == 'push' }}");
+  expect(workflow).toContain('if: ${{ false }}');
+  expect(workflow).toContain('GITHUB_RUN_ID is required');
   expect(workflow).toContain('RELEASE_ENV=staging');
   expect(workflow).toContain('bun run test:release-gates');
   expect(workflow).toContain('docker compose config --quiet');
   expect(workflow).toContain('docker build --build-arg APP_RELEASE_ID=fixture-ci');
+  expect(workflow).toContain('GITHUB_RUN_ATTEMPT');
   expect(workflow).toContain('--network none');
 });
 
@@ -27,4 +30,5 @@ test('Compose and Docker defaults are isolated and digest-pinned', () => {
   for (const pattern of ['*.pem', '*.key', '*.p12', '*.pfx', 'credentials*', 'secrets*', '.npmrc']) {
     expect(dockerignore).toContain(pattern);
   }
+  expect(convexConfig).toContain("'APP_CAPABILITY_ALLOWLIST'");
 });