test(handoff): add fail-closed evidence schema and qualification records

docs/automation/handoffs/pre-phase10/verify_git.py

@@ -1,6 +1,7 @@
 """Bounded read-only Gitea diagnostics; credentials remain in Git's configured helper."""
 import datetime
 import json
+import os
 from pathlib import Path
 import socket
 import ssl
@@ -20,6 +21,8 @@ def main():
         return result
     url = git('remote', 'get-url', 'origin').stdout.strip()
     assert url == 'https://git.cesnimda.uk/cesnimda/jobtrackingapp.git'
+    assert os.getenv('GIT_SSL_NO_VERIFY', '').lower() not in ('1', 'true', 'yes'), 'Git TLS verification is disabled in the environment'
+    assert git('config', '--get-urlmatch', 'http.sslVerify', url).stdout.strip().lower() not in ('false', '0', 'no'), 'Git TLS verification is disabled for this remote'
     record = dict(observedUtc=datetime.datetime.now(datetime.timezone.utc).isoformat(), remote=url,
                   localCommit=git('rev-parse', 'HEAD').stdout.strip(), tlsVerificationDisabled=False)
     try: