diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index d6fba524..af5a819b 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -74,7 +74,7 @@ jobs:
         # actions/checkout@v4 fails before tests can start.
         run: |
           if command -v apk >/dev/null 2>&1; then
-            apk add --no-cache nodejs npm git curl bash openssh-client docker-cli docker-cli-buildx
+            apk add --no-cache nodejs npm git curl bash coreutils python3 openssh-client docker-cli docker-cli-buildx
           fi
 
       - uses: actions/checkout@v4
@@ -320,7 +320,7 @@ jobs:
         # actions/checkout@v4 and Telegram failure notifications run.
         run: |
           if command -v apk >/dev/null 2>&1; then
-            apk add --no-cache nodejs npm git curl bash openssh-client docker-cli docker-cli-buildx
+            apk add --no-cache nodejs npm git curl bash coreutils python3 openssh-client docker-cli docker-cli-buildx
           fi
 
       - uses: actions/checkout@v4
@@ -1218,7 +1218,7 @@ jobs:
         # notifications, so it needs the same runner bootstrap as earlier jobs.
         run: |
           if command -v apk >/dev/null 2>&1; then
-            apk add --no-cache nodejs npm git curl bash openssh-client docker-cli docker-cli-buildx
+            apk add --no-cache nodejs npm git curl bash coreutils python3 openssh-client docker-cli docker-cli-buildx
           fi
 
       - uses: actions/checkout@v4
diff --git a/apps/api/src/services/ai_agent_report_no_write_analysis_runtime.py b/apps/api/src/services/ai_agent_report_no_write_analysis_runtime.py
index 60afc296..6319d4fe 100644
--- a/apps/api/src/services/ai_agent_report_no_write_analysis_runtime.py
+++ b/apps/api/src/services/ai_agent_report_no_write_analysis_runtime.py
@@ -24,7 +24,7 @@ _EXPECTED_CURRENT_TASK = "P2-407"
 _EXPECTED_NEXT_TASK = "P2-408"
 _EXPECTED_CANONICAL_ROOM = "AwoooI SRE 戰情室"
 _EXPECTED_CANONICAL_ROOM_ENV = "SRE_GROUP_CHAT_ID"
-# 2026-06-18 Codex: 部署錨點；不改變 P2-407 no-write snapshot 或 CD lock 解析行為。
+# 2026-06-18 Codex: 部署錨點；不改變 P2-407 no-write snapshot 或 runner toolchain 行為。
 _EXPECTED_SOURCE_SCHEMAS = {
     "ai_agent_report_status_board_v1",
     "ai_agent_report_automation_review_v1",