fix(ci): guard wbs verdict coverage

tools/validate_gitea_ci_workflow_lint_v1.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import argparse
 import json
+import re
 from pathlib import Path
 
 import yaml
@@ -35,17 +36,46 @@ def main() -> int:
     core = jobs.get("validate-core") or {}
     services = core.get("services") or {}
     postgres = services.get("postgres") or {}
+    ci_text = workflow_path.read_text(encoding="utf-8")
 
     ports = postgres.get("ports") or []
     if any(str(port).strip() == "5432:5432" for port in ports):
         errors.append("validate-core.services.postgres.ports contains fixed host mapping 5432:5432")
 
-    if "PGHOST: postgres" not in workflow_path.read_text(encoding="utf-8"):
+    if "PGHOST: postgres" not in ci_text:
         errors.append("workflow does not pin PGHOST=postgres for CI database steps")
 
-    if "QE_WBS_PG_DSN=host=postgres" not in workflow_path.read_text(encoding="utf-8"):
+    if "QE_WBS_PG_DSN=host=postgres" not in ci_text:
         errors.append("workflow does not publish QE_WBS_PG_DSN with service hostname")
 
+    spec_path = ROOT / "spec" / "60_quant_engine_wbs.yaml"
+    spec = _load_yaml(spec_path)
+    done_tasks: list[str] = []
+    for task_id, task in (spec.get("tasks") or {}).items():
+        if (task or {}).get("status") != "DONE":
+            continue
+        mode = ((task or {}).get("execution") or {}).get("mode")
+        if mode == "not_ci_reproducible":
+            continue
+        done_tasks.append(task_id)
+    done_tasks.sort()
+
+    match = re.search(
+        r"for task in (?P<tasks>.+?); do\s+python3 tools/verify_wbs_task_v1\.py --task \"?\$?task\"?\s+done",
+        ci_text,
+        re.S,
+    )
+    if not match:
+        errors.append("workflow missing Generate DONE WBS Verdicts task list")
+    else:
+        declared = re.findall(r"QE-[A-Z0-9-]+", match.group("tasks"))
+        missing = [task for task in done_tasks if task not in declared]
+        extra = [task for task in declared if task not in done_tasks]
+        if missing:
+            errors.append("workflow omits DONE verdict tasks: " + ", ".join(missing))
+        if extra:
+            errors.append("workflow includes non-DONE verdict tasks: " + ", ".join(extra))
+
     result = {
         "formula_id": "GITEA_CI_WORKFLOW_LINT_V1",
         "gate": "PASS" if not errors else "FAIL",