fix(cv): isolate document parsing

Run untrusted document decoders in a secret-free, resource-bounded child process and terminate its process tree on deadline. Harden the production container and enforce parser and lint gates in CI.

.gitea/workflows/ci-deploy.yml

@@ -60,6 +60,18 @@ jobs:
         # without contacting Ollama, pulling a model, or requiring package installation.
         run: python3 scripts/test-ollama-evaluation.py
 
+      - name: Test document parser boundary
+        working-directory: tools/summarizer
+        run: |
+          python3 -m venv .venv-ci
+          . .venv-ci/bin/activate
+          python -m pip install --upgrade pip
+          python -m pip install --require-hashes \
+            --extra-index-url https://download.pytorch.org/whl/cpu \
+            -r requirements-linux.lock
+          python -m pip install pytest==8.3.5 httpx2==2.12.0
+          AI_SERVICE_SKIP_MODEL_LOAD=1 python -m pytest -q
+
       - name: Restore backend
         # The runner/proxy has occasionally supplied checksum-invalid NuGet cache entries (NU3008).
         # Retry from clean HTTP/global caches; signature verification remains enabled.
@@ -144,6 +156,10 @@ jobs:
         working-directory: job-tracker-ui
         run: npm audit --audit-level=high
 
+      - name: Lint frontend
+        working-directory: job-tracker-ui
+        run: npm run lint
+
       - name: Test frontend
         working-directory: job-tracker-ui
         # Run the WHOLE suite. Never whitelist test files here again: the previous