fix(ci): add workflow lint harness

tools/validate_gitea_ci_workflow_lint_v1.py

@@ -0,0 +1,62 @@
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+
+import yaml
+
+
+ROOT = Path(__file__).resolve().parents[1]
+DEFAULT_WORKFLOW = ROOT / ".gitea" / "workflows" / "ci.yml"
+
+
+def _load_yaml(path: Path) -> dict:
+    return yaml.safe_load(path.read_text(encoding="utf-8")) or {}
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description="Lint the QuantEngine CI workflow for recurring service-binding mistakes.")
+    ap.add_argument("--workflow", default=str(DEFAULT_WORKFLOW))
+    args = ap.parse_args()
+
+    workflow_path = Path(args.workflow)
+    if not workflow_path.is_absolute():
+        workflow_path = (ROOT / workflow_path).resolve()
+    data = _load_yaml(workflow_path)
+
+    errors: list[str] = []
+    evidence: dict[str, object] = {
+        "workflow": str(workflow_path.relative_to(ROOT)),
+        "jobs": sorted((data.get("jobs") or {}).keys()),
+    }
+
+    jobs = data.get("jobs") or {}
+    core = jobs.get("validate-core") or {}
+    services = core.get("services") or {}
+    postgres = services.get("postgres") or {}
+
+    ports = postgres.get("ports") or []
+    if any(str(port).strip() == "5432:5432" for port in ports):
+        errors.append("validate-core.services.postgres.ports contains fixed host mapping 5432:5432")
+
+    if "PGHOST: postgres" not in workflow_path.read_text(encoding="utf-8"):
+        errors.append("workflow does not pin PGHOST=postgres for CI database steps")
+
+    if "QE_WBS_PG_DSN=host=postgres" not in workflow_path.read_text(encoding="utf-8"):
+        errors.append("workflow does not publish QE_WBS_PG_DSN with service hostname")
+
+    result = {
+        "formula_id": "GITEA_CI_WORKFLOW_LINT_V1",
+        "gate": "PASS" if not errors else "FAIL",
+        "errors": errors,
+        "evidence": evidence,
+    }
+    out = ROOT / "Temp" / "gitea_ci_workflow_lint_v1.json"
+    out.write_text(json.dumps(result, ensure_ascii=False, indent=2), encoding="utf-8")
+    print(json.dumps(result, ensure_ascii=False, indent=2))
+    return 0 if not errors else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())