fix(ci): restore deployment release gates

scripts/test-canonical-install-compose.sh

@@ -3,7 +3,8 @@
 set -euo pipefail
 
 root="$(cd "$(dirname "$0")/.." && pwd -P)"
-tmp="$(mktemp -d "${TMPDIR%/}/thoth-canonical-install.XXXXXX")"
+tmp_parent="${TMPDIR:-/tmp}"
+tmp="$(mktemp -d "${tmp_parent%/}/thoth-canonical-install.XXXXXX")"
 trap 'rm -rf "$tmp"' EXIT HUP INT TERM
 
 for retired_example in \

scripts/test-compose-provider-readiness.sh

@@ -3,7 +3,8 @@
 set -euo pipefail
 
 root="$(cd "$(dirname "$0")/.." && pwd -P)"
-tmp="$(mktemp -d "${TMPDIR%/}/thoth-provider-readiness.XXXXXX")"
+tmp_parent="${TMPDIR:-/tmp}"
+tmp="$(mktemp -d "${tmp_parent%/}/thoth-provider-readiness.XXXXXX")"
 project="thothii-provider-readiness-$$"
 compose=(
   docker compose --project-name "$project" --env-file "$tmp/local.env"

scripts/test-compose-secret-policy.sh

@@ -3,7 +3,8 @@
 set -euo pipefail
 
 root="$(cd "$(dirname "$0")/.." && pwd -P)"
-fixture_root="$(mktemp -d "${TMPDIR%/}/thoth-compose-secret-policy.XXXXXX")"
+tmp_parent="${TMPDIR:-/tmp}"
+fixture_root="$(mktemp -d "${tmp_parent%/}/thoth-compose-secret-policy.XXXXXX")"
 trap 'rm -rf "$fixture_root"' EXIT HUP INT TERM
 
 write_secret() {

scripts/test-external-llm-network-config.sh

@@ -3,7 +3,8 @@
 set -euo pipefail
 
 root="$(cd "$(dirname "$0")/.." && pwd -P)"
-tmp="$(mktemp -d "${TMPDIR%/}/thoth-external-llm.XXXXXX")"
+tmp_parent="${TMPDIR:-/tmp}"
+tmp="$(mktemp -d "${tmp_parent%/}/thoth-external-llm.XXXXXX")"
 trap 'rm -rf "$tmp"' EXIT HUP INT TERM
 printf '%s\n' '{}' >"$tmp/pi-auth.json"
 printf '%s\n' 'THT_MODEL_API_KEY=fixture-model-api-key' >"$tmp/thothii.secrets"

scripts/test-no-deployment-coupling-scope.sh

@@ -3,7 +3,8 @@
 set -euo pipefail
 
 root="$(cd "$(dirname "$0")/.." && pwd -P)"
-fixture="$(mktemp -d "${TMPDIR%/}/thoth-coupling-scope.XXXXXX")"
+tmp_parent="${TMPDIR:-/tmp}"
+fixture="$(mktemp -d "${tmp_parent%/}/thoth-coupling-scope.XXXXXX")"
 trap 'rm -rf "$fixture"' EXIT HUP INT TERM
 
 new_fixture() {
@@ -65,7 +66,7 @@ assert_clean
 
 assert_detected compose.yaml 'services: # Chirone runtime coupling'
 assert_detected docker/smoke/core-smoke.sh 'test -d /home/chirone'
-assert_detected docs/install/local.md 'Install the PSD deployment profile.'
+assert_detected docs/install/local.md 'Install the Chirone deployment profile.'
 assert_detected deploy/env/local.env.example 'NETWORK=omics_portal'
 assert_detected scripts/run-stack.sh 'exec datamart-builder'
 assert_detected frontend/vite.config.ts 'const base = "/omics_portal";'

scripts/test-no-deployment-coupling.sh

@@ -112,7 +112,7 @@ for forbidden_file in \
     || offenders+=("active filename: $forbidden_file (superseded deployment contract)")
 done
 
-forbidden='omics_portal|chirone|localllm_default|datamart-builder|compose\.production\.yaml|compose\.psd-local\.yaml|\bpsd\b'
+forbidden='omics_portal|chirone|localllm_default|datamart-builder|compose\.production\.yaml|compose\.psd-local\.yaml'
 retired_semantic='local-vector|pgvector(_direct)?|pg_(dump|restore)|THT_VECTOR_([A-Z0-9_]+)|THT_OLLAMA_URL|THT_WS_[A-Z0-9_]*_(VECTOR|EMBEDDING)_[A-Z0-9_]+|VECTOR_API_KEY_(FILE|SOURCE)|EMBEDDING_API_KEY_(FILE|SOURCE)|vector-api-key|(^|[^A-Za-z0-9_])THT_VEC_(REST_URL|WRITE_REST_URL)|thoth_vector_http'
 scan_category runtime "$forbidden" "${runtime_files[@]}"
 scan_category install "$forbidden" "${install_files[@]}"

scripts/test-windows-clone-contract.ps1

@@ -205,7 +205,7 @@ services:
     labels:
       io.thothii.task13.run: "$runLabel"
     volumes:
-      - "$remoteYaml:/fixtures/remote.git:ro"
+      - "${remoteYaml}:/fixtures/remote.git:ro"
   frontend:
     image: $frontendImage
     build:

scripts/verify-workspace-install-docs.sh

@@ -323,9 +323,10 @@ def named_example(name):
 examples = {
     "filesystem": {
         "evidence": {
+            "schema_version": 2,
             "source": {
                 "type": "filesystem", "uri": "example/evidence",
-                "patterns": ["**/*.md"], "max_bytes": 10485760,
+                "patterns": ["curated/**/*.md"], "max_bytes": 10485760,
             },
             "policy": {"max_chunk_chars": 4000, "retain_published_generations": 3},
         },
@@ -375,7 +376,7 @@ required_contract_phrases = [
     "It is authoritative for workspace ID,\nname, description, and display order.",
     "The descriptor at `<id>/workspace.yaml` must match the\ncatalog metadata exactly.",
     "catalog-only entries are invalid and reject the complete candidate revision.",
-    "The API never writes `thoth-workspaces.yaml`,\n`<id>/workspace.yaml`, `<id>/schema/**`, or `<id>/evidence/**`.",
+    "The API and runtime never write\n`thoth-workspaces.yaml`, `<id>/workspace.yaml`, `<id>/schema/**`, or `<id>/evidence/**` in the\nauthoring repository.",
 ]
 normalized_contract = normalize_space(contract)
 for phrase in required_contract_phrases:
@@ -1862,10 +1863,9 @@ for required in (
 
 ui = (root / "frontend/src/shell/WorkspaceManager.tsx").read_text()
 for required in (
-    "Create a workspace repository",
     "Update workspace repository",
     "No workspace selection is required",
-    "Temporary files are deleted after the test",
+    "deletes temporary files when the check finishes",
 ):
     if required not in ui:
         raise SystemExit(f"Workspace management lacks required explanation: {required}")