fix(ci): include deploy readback test in narrow cd profile

.gitea/workflows/cd.yaml

@@ -436,6 +436,8 @@ jobs:
                 ;;
               apps/api/tests/test_iwooos_security_operating_system.py)
                 ;;
+              apps/api/tests/test_awoooi_production_deploy_readback_blocker.py)
+                ;;
               apps/api/tests/e2e_network_test.py)
                 ;;
               apps/api/tests/test_p0_cicd_baseline_source_readiness_api.py)
@@ -668,6 +670,7 @@ jobs:
               tests/test_gitea_workflow_runner_owner_attestation_request_api.py \
               tests/test_reboot_auto_recovery_slo_scorecard_api.py \
               tests/test_iwooos_security_operating_system.py \
+              tests/test_awoooi_production_deploy_readback_blocker.py \
               tests/e2e_network_test.py::TestHMACVerification::test_valid_hmac_signature \
               tests/test_p0_cicd_baseline_source_readiness_api.py \
               tests/test_product_awoooi_manifest_standard_api.py \

ops/runner/test_cd_controlled_runtime_profile.py

@@ -52,6 +52,8 @@ def test_workflow_secret_transport_sources_stay_on_controlled_runtime_profile()
 
 def test_cd_requires_production_deploy_readback_after_rollout() -> None:
     text = _workflow_text()
+    assert "apps/api/tests/test_awoooi_production_deploy_readback_blocker.py)" in text
+    assert "tests/test_awoooi_production_deploy_readback_blocker.py" in text
     assert "production_deploy_readback_mismatch=" in text
     assert "production_deploy_runtime_build_commit_short_sha" in text
     assert "production_deploy_desired_main_api_image_tag_short_sha" in text