ci: test whether EF-InMemory/Moq (runtime IL emission) is the runner trigger

.gitea/workflows/ci-deploy.yml

@@ -68,6 +68,24 @@ jobs:
       # under a hostile locale/timezone -- so the trigger is specific to this runner host.
       # See docs/infrastructure/runner-investigation.md. Collection parallelism stays off for determinism, the
       # same reason the frontend runs --runInBand. Every test still runs; nothing is filtered.
+      # Post-reboot the failure is identical (smoke 1s pass, suite 3s fail), so it is deterministic,
+      # not an OOM/flake -- and host telemetry shows no disk/memory/PID pressure. The passing smoke is
+      # a PURE test (no EF, no Moq); every class known to fail uses EF InMemory + Moq, whose Castle
+      # DynamicProxy emits IL at runtime. A container seccomp/W^X policy that blocks runtime code
+      # generation would kill the host exactly this way. These ordered steps test that: pure classes
+      # first, then a Moq+EF class. Diagnostic scaffolding; no test is skipped or weakened.
+      - name: T pure JobPipeline
+        run: dotnet test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-build --filter "FullyQualifiedName~JobPipelineTests"
+
+      - name: T pure EmailStatusClassifier
+        run: dotnet test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-build --filter "FullyQualifiedName~EmailStatusClassifierTests"
+
+      - name: T pure JobCvMatchService
+        run: dotnet test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-build --filter "FullyQualifiedName~JobCvMatchServiceTests"
+
+      - name: T MoqEF CvBuilder
+        run: dotnet test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-build --filter "FullyQualifiedName~CvBuilderTests"
+
       - name: Test backend
         run: dotnet test JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-build -- xUnit.parallelizeTestCollections=false xUnit.maxParallelThreads=1