fix: pin model revisions and quarantine MariaDB CI routing

scripts/test-mariadb-workflow.py

@@ -0,0 +1,34 @@
+"""Repository quarantine guards; these never certify actual runner isolation."""
+from pathlib import Path
+import re
+import unittest
+
+WORKFLOW = Path(__file__).resolve().parents[1] / '.gitea/workflows/mariadb-integration.yml'
+
+
+class MariaDbWorkflowQuarantine(unittest.TestCase):
+    def setUp(self):
+        self.text = WORKFLOW.read_text(encoding='utf-8')
+
+    def test_requires_dedicated_routing_instead_of_shared_deployment_label(self):
+        self.assertRegex(self.text, r'(?m)^    runs-on: jobtracker-mariadb-isolated$')
+        self.assertNotRegex(self.text, r'(?m)^    runs-on: ubuntu-latest$')
+
+    def test_untrusted_pull_requests_cannot_automatically_prepare_a_job(self):
+        self.assertNotRegex(self.text, r'(?m)^  pull_request(?:_target)?:')
+
+    def test_operator_blocker_precedes_checkout_and_database_execution(self):
+        guard = self.text.index('- name: Require verified runner isolation')
+        checkout = self.text.index('- uses: actions/checkout')
+        self.assertLess(guard, checkout)
+        self.assertRegex(self.text[guard:checkout], r'(?m)^          exit 1$')
+
+    def test_current_development_branch_keeps_a_visible_qualification_lane(self):
+        self.assertIn('fix/p9-model-cache-and-ci-qualification', self.text)
+        self.assertIn('python3 scripts/mariadb-integration.py', self.text)
+        self.assertNotIn('privileged:', self.text)
+        self.assertNotIn('/var/run/docker.sock', self.text)
+
+
+if __name__ == '__main__':
+    unittest.main()