docs(infra): docs-only commit fails CI identically — proves failure is not in the repo

Run 531 (8f73548) changed a single markdown file: no application code, no test,
no dependency, no workflow file. Its test job failed at 1m18s, in the same
duration band as every run before and after it, including the two Phase 5
milestone commits.

A change that cannot affect compilation or test behaviour cannot cause a test
job to fail. That settles the question the investigation was asked: the cause is
outside the repository. The specific runner mechanism is still unidentified and
still needs the access already listed (job logs via a read-scoped token,
journalctl -u act_runner, runner container config).

Also records a separately discovered, pre-existing bug: booting against a
completely empty MariaDB fails because the MySQL reconciler assumes the
migration-owned tables exist. Reproduced on clean HEAD, unrelated to CI, and
harmless to prod, whose database is populated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/infrastructure/runner-investigation.md

@@ -220,6 +220,42 @@ changed host key / rotated `PROD_SSH_KEY`. Confidence: **medium (~50 %)** — th
 
 ---
 
+## Decisive evidence: a docs-only commit fails identically (2026-07-19)
+
+The strongest single data point, found while pushing Phase 5 Milestone 2:
+
+| Run | Commit | What it changed | `test` job |
+|---|---|---|---|
+| 531 | `8f73548` | **one markdown file** — `docs/infrastructure/runner-investigation.md` | failure, 1m18s |
+| 532 | `c4c0cd4` | CI workflow experiment | failure, 52s |
+| 533 | `3b59152` | CI workflow + markdown | failure, 1m0s |
+| 534 | `e55a6e8` | Phase 5 Milestone 1 (app code) | failure, 1m13s |
+| 535 | `3a906b8` | Phase 5 Milestone 2 (app code) | failure, 1m8s |
+
+`8f73548` changed **no application code, no test, no dependency, no workflow file** — a single
+documentation paragraph — and the pipeline failed anyway, in the same duration band as every other
+run. A change that cannot affect compilation or test behaviour cannot cause a test job to fail.
+
+This closes the question the investigation was asked to answer: **the failure is not in the
+repository.** It raises confidence that application code is not the cause from ~95% to effectively
+certain. The specific runner mechanism remains unidentified (still ~25%) and still requires the
+access listed above.
+
+Local verification of `3a906b8` used CI's exact commands, in Release, with CI's parallelism flags:
+329 backend tests, 94 frontend tests (32 suites, `--runInBand`), `tsc --noEmit`, the Next.js
+production build, and both Docker images — all green.
+
+### Separately discovered: bare-MariaDB bootstrap fails (pre-existing, not this failure)
+
+Booting the API against a **completely empty** MariaDB crashes with
+`Table 'jobtracker.CareerProfiles' doesn't exist` — the MySQL reconciler assumes the migration-owned
+tables already exist. Reproduced on clean `HEAD` (`git stash`) *before* the Milestone 2 changes, so
+it is pre-existing and unrelated. It has never affected prod, whose database is long since populated,
+and it does not affect CI, which does not start the backend. Worth fixing on its own, but out of
+scope here and **not** the runner failure.
+
+---
+
 ## Repository state
 
 Kept — all correct independent of the outcome, none reverted: