test(ci): prepare immutable central workflow contract verification

[seonghobae]

Source preparation only

Preserve the active Security and Quality workflow while preparing its executable-gate tests for a future immutable central thin caller. No workflow activation, runner access, secrets, protection, merge or deployment change.

• Add an offline test fixture reader that requires the fixed central repository, exact 40-hex reference, SHA-256, Git blob identity and a review-controlled protected publication receipt.
• Keep the publication receipt null: supplier ci: add isolated contextual-orchestrator security supplier .github#2634 remains unmerged. Attempting to activate this candidate fails closed.
• Preserve original executable quality/security assertions and local trigger/concurrency checks. The fixtures are inert test data, not a second executable CI implementation.
• The reader supports only the explicit thin-caller shape; it is not a general YAML parser or a security authorization mechanism.

Verification

22 focused/adversarial tests passed with warnings as errors against the current local workflow, and 22 passed against a temporary simulated-published caller.
Original executable-contract assertion reproduced RED on the thin caller before adaptation. Fixture Git blob IDs match the live exact-commit GitHub API. Python compileall passed. Parent independent source review and rerun passed.

The simulated publication marker existed only in a temporary test directory; it is not live publication evidence and is absent from this commit. Full product runtime suites, exact-head Actions and qualifying independent approval remain required. Before eventual activation, re-fetch the protected merged supplier, refresh its fixture and manifest from that exact commit, establish isolated-runner admission/cleanup evidence, and verify actual check contexts. No synthetic caller pin is published here.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}