fix(cd): keep ui changes on controlled profile

.gitea/workflows/cd.yaml

@@ -190,6 +190,12 @@ jobs:
           while IFS= read -r changed_file; do
             [ -z "$changed_file" ] && continue
             case "$changed_file" in
+              # 2026-06-29 Codex: UI-only changes are verified by the
+              # frontend build in build-and-deploy. Keep them on the narrow
+              # profile so non-110 CD does not run B5's Docker/socket DB
+              # integration for copy/layout fixes.
+              apps/web/*)
+                ;;
               .gitea/workflows/cd.yaml)
                 ;;
               docs/LOGBOOK.md)
@@ -262,6 +268,8 @@ jobs:
                 ;;
               ops/runner/test_read_public_gitea_actions_queue.py)
                 ;;
+              ops/runner/test_cd_controlled_runtime_profile.py)
+                ;;
               ops/runner/test_verify_awoooi_non110_cd_closure.py)
                 ;;
               ops/runner/verify-awoooi-non110-cd-closure.py)
@@ -374,6 +382,7 @@ jobs:
               tests/test_p0_cicd_baseline_source_readiness_api.py \
               tests/test_trust_drift_watchdog.py \
               ../../ops/runner/test_read_public_gitea_actions_queue.py \
+              ../../ops/runner/test_cd_controlled_runtime_profile.py \
               ../../ops/runner/test_verify_awoooi_non110_cd_closure.py \
               -v --tb=short -x -p no:cacheprovider \
               2>&1 | tee /tmp/pytest-output.txt; PYTEST_EXIT=${PIPESTATUS[0]}

ops/runner/test_cd_controlled_runtime_profile.py

@@ -0,0 +1,30 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+CD_WORKFLOW = ROOT / ".gitea" / "workflows" / "cd.yaml"
+
+
+def _workflow_text() -> str:
+    return CD_WORKFLOW.read_text(encoding="utf-8")
+
+
+def test_web_changes_stay_on_controlled_runtime_profile() -> None:
+    text = _workflow_text()
+    assert "apps/web/*)" in text
+    assert "UI-only changes are verified by the" in text
+
+
+def test_controlled_runtime_skips_b5_before_docker_socket_use() -> None:
+    text = _workflow_text()
+    b5_start = text.index("- name: Integration Tests (B5")
+    docker_socket = text.index("-v /var/run/docker.sock:/var/run/docker.sock", b5_start)
+    controlled_gate = text.index(
+        'if [ "${AWOOOI_CD_TEST_PROFILE:-full}" = "controlled-runtime" ]; then',
+        b5_start,
+    )
+    exit_zero = text.index("exit 0", controlled_gate)
+    assert controlled_gate < exit_zero < docker_socket