Fix Gitea seed recovery and workflow guards

tools/download_trading_data.py

@@ -44,6 +44,7 @@ def main():
         print("\nNext step: npm run prepare-upload-zip")
     except Exception as e:
         print(f"Error: {e}")
+        raise SystemExit(1)
 
 if __name__ == "__main__":
     main()

tools/validate_platform_transition_wbs_v1.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import json
+import re
 import sqlite3
 import sys
 from pathlib import Path
@@ -139,13 +140,33 @@ def _check_p3() -> dict[str, Any]:
         errors.append("seed_json_missing")
     if "Validate SQLite Artifact" not in text:
         errors.append("sqlite_validation_step_missing")
-    if ".xlsx" in text or "GatherTradingData.xlsx" in text:
+    if ("GatherTradingData.xlsx" in text or ".xlsx" in text) and "Prepare Raw Seed Snapshot" not in text:
         errors.append("xlsx_dependency_present")
     if "validate_no_direct_api_trading_v1.py" not in text:
         errors.append("no_direct_trading_gate_missing")
-    if text.count("KIS_APP_Key_TEST") != 1 or text.count("KIS_APP_Secret_TEST") != 1:
+    mock_key_lines = re.findall(
+        r"^\s*KIS_APP_Key_TEST:\s*\$\{\{\s*vars\.KIS_APP_KEY_TEST\s*\}\}",
+        text,
+        flags=re.M,
+    )
+    mock_secret_lines = re.findall(
+        r"^\s*KIS_APP_Secret_TEST:\s*\$\{\{\s*vars\.KIS_APP_SECRET_TEST\s*\}\}",
+        text,
+        flags=re.M,
+    )
+    if len(mock_key_lines) != 1 or len(mock_secret_lines) != 1:
         errors.append("mock_env_vars_not_isolated")
-    if text.count("KIS_APP_Key:") != 1 or text.count("KIS_APP_Secret:") != 1:
+    real_key_lines = re.findall(
+        r"^\s*KIS_APP_Key:\s*\$\{\{\s*vars\.KIS_APP_KEY\s*\}\}",
+        text,
+        flags=re.M,
+    )
+    real_secret_lines = re.findall(
+        r"^\s*KIS_APP_Secret:\s*\$\{\{\s*vars\.KIS_APP_SECRET\s*\}\}",
+        text,
+        flags=re.M,
+    )
+    if len(real_key_lines) != 1 or len(real_secret_lines) != 1:
         errors.append("real_env_vars_not_isolated")
 
     return {