fix(ci): provision integration fixtures

scripts/test-verify-schema-v3-only.sh

@@ -577,6 +577,10 @@ expect_rejected "nested workspace fixture" "scripts/fixtures/nested/deeper/works
 # Python bytecode is disabled before pre-gate docs, and release dry-run starts with bootstrap trust.
 grep -Fq 'PYTHONDONTWRITEBYTECODE: "1"' "$project_root/.github/workflows/deployment.yml" \
   || fail "workflow does not disable Python bytecode"
+grep -Fq 'python3 -m venv .venv' "$project_root/.github/workflows/deployment.yml" \
+  || fail "workflow does not install the real harness CLI before backend integration tests"
+grep -Fq '.venv/bin/python -m pip install -e .' "$project_root/.github/workflows/deployment.yml" \
+  || fail "workflow does not install the harness package into its canonical virtual environment"
 grep -Fq 'export PYTHONDONTWRITEBYTECODE=1' "$project_root/scripts/verify-schema-v3-only-release.sh" \
   || fail "release wrapper does not disable Python bytecode"
 release_plan="$($gate_bash "$project_root/scripts/verify-schema-v3-only-release.sh" --dry-run)"

scripts/test-windows-clone-contract.ps1

@@ -142,10 +142,12 @@ try {
 
     $piAuth = Join-Path $fixtureRoot "Pi Auth/pi-auth.json"
     $secrets = Join-Path $fixtureRoot "Secrets/thothii.secrets"
+    $authConfigRoot = Join-Path $fixtureRoot "Auth Config"
     $secretValue = "windows-contract-$runId"
     $script:SensitiveValues.Add($secretValue)
     Write-Utf8File $piAuth "{}`n"
     Write-Utf8File $secrets "THT_MODEL_API_KEY=$secretValue`n"
+    [System.IO.Directory]::CreateDirectory($authConfigRoot) | Out-Null
 
     $remote = Join-Path $fixtureRoot "Workspace Remote/remote.git"
     $seed = Join-Path $fixtureRoot "Workspace Seed"
@@ -190,6 +192,7 @@ THOTH_HTTP_PORT=0
 THOTH_CORE_HTTP_PORT=0
 PI_AUTH_FILE=$piAuth
 THT_SECRETS_FILE=$secrets
+THT_AUTH_CONFIG_ROOT=$authConfigRoot
 THT_WORKSPACE_GIT_REMOTE=/fixtures/remote.git
 THT_WORKSPACE_GIT_BRANCH=main
 THT_WORKSPACE_INSTALLATION_ID=task13-windows