test: qualify immutable models and Phase 9 regression

docs/redesign/phase-9/p9-sec-02/linux-run.py

@@ -0,0 +1,26 @@
+"""Reuse the qualified isolated renderer lifecycle; retain each remediation attempt separately."""
+import importlib.util
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+spec = importlib.util.spec_from_file_location('qualified_linux_runner', HERE.parent/'p9-requal-01/linux-run.py')
+runner = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(runner)
+
+if len(sys.argv) != 2 or not re.fullmatch(r'[a-z0-9-]+', sys.argv[1]):
+    raise SystemExit('Supply a unique lowercase attempt name; prior evidence is never overwritten.')
+runner.OUT = runner.ROOT/'.artifacts/p9-sec-02'/sys.argv[1]/'linux'
+if sys.argv[1] != 'baseline':
+    expected='sha256:0d1cb44ba8f71d54de77459915a7052b894191cfeb75aa32f0c1e7ffdc21fda6'
+    actual=subprocess.check_output(['rtk','proxy','docker','image','inspect','--format','{{.Id}}','jobtracker-p9-remed-api:fonts'],text=True,timeout=10).strip()
+    if actual!=expected:raise SystemExit('Qualified local PDF image identity changed; requalification required.')
+    runner.IMAGE = expected  # Local image ID, not a claimed pullable registry manifest.
+    runner.VERSION = 'p9-remed-02-fonts'  # Unchanged fixture readiness token; actual image/source are verified separately.
+    runner.CONFIG = '../docs/redesign/phase-9/p9-remed-02/linux/playwright.config.ts'
+    if sys.argv[1] == 'representative-linux':
+        runner.CONFIG = '../docs/redesign/phase-9/p9-remed-02/representative/playwright.config.ts'
+    runner.COMMIT = 'e80815f8df94d26f7d35b8249b4e6e1a65922df3'
+runner.main()