feat: harden firewall policies telemetry and operations

Implement reliable agent apply, telemetry v2, analytics retention, guarded rollouts, enrollment, labels and webhooks. Improve ReUI frontend data safety and bounded list loading, and add Docker smoke, recovery and resource checks. Document local verification and pending native acceptance.

.gitea/workflows/cd.yaml

@@ -7,6 +7,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: evofw-release
+  cancel-in-progress: false
+
 jobs:
   quality:
     uses: ./.gitea/workflows/quality.yaml
@@ -96,9 +100,13 @@ jobs:
         if: steps.rel.outputs.released == 'true'
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
         with:
-          name: evofw
+          name: evofw-${{ github.run_id }}-${{ github.run_attempt }}-publish
           driver: docker-container
-          cleanup: false
+          cleanup: true
+          buildkitd-config: deploy/docker/buildkitd.toml
+      - name: Verify run-scoped builder effective GC configuration
+        if: steps.rel.outputs.released == 'true'
+        run: sh scripts/ci/prepare-builder.sh evofw-${{ github.run_id }}-${{ github.run_attempt }}-publish deploy/docker/buildkitd.toml
       - name: Prepare image metadata
         if: steps.rel.outputs.released == 'true'
         id: meta

.gitea/workflows/quality.yaml

@@ -116,8 +116,9 @@ jobs:
               .gitea/workflows/*|scripts/*)
                 full_pipeline=true
                 ;;
-              docs/openapi.yaml|redocly.yaml)
+              docs/openapi.yaml|docs/openapi.schemas.json|redocly.yaml)
                 openapi=true
+                api=true
                 ;;
               .cursor/*|.claude/*|.codegraph/*|.agents/*)
                 ;;
@@ -270,7 +271,11 @@ jobs:
           # turbo builds @evofw/{shared,db} first — api typecheck resolves their dist types
           pnpm exec turbo run typecheck --filter=@evofw/api --filter=@evofw/db --filter=@evofw/shared
           pnpm exec turbo run test --filter=@evofw/api --filter=@evofw/shared
+          node --test scripts/ci/sqlite-backup.test.mjs
           pnpm exec turbo run build --filter=@evofw/api
+          node --test scripts/ci/benchmark-fixture.test.mjs
+          node --test scripts/ci/manifest-platform.test.mjs
+          node scripts/ci/generate-openapi-schemas.mjs --check
 
   commitlint:
     if: inputs.is_pull_request
@@ -311,17 +316,39 @@ jobs:
           sh scripts/ci/pnpm-ci.sh
           pnpm exec commitlint --from "$BASE_SHA" --to "$HEAD_SHA"
 
-  docker-check:
+  linux-agent-smoke:
     needs: [changes]
-    if: inputs.is_pull_request && needs.changes.outputs.docker == 'true'
+    if: needs.changes.outputs.api == 'true' || needs.changes.outputs.docker == 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Install isolated Linux smoke prerequisites
+        run: sudo apt-get update && sudo apt-get install -y iproute2 nftables iptables ipset python3 curl util-linux coreutils
+      - name: Run shipped agent in isolated network and mount namespaces
+        run: |
+          python3 scripts/ci/linux-agent-fixture.test.py
+          sudo bash scripts/ci/linux-netns-smoke.sh
+
+  docker-check:
+    needs: [changes]
+    # Every CD invocation must pass upgrade validation, including docs-only releases.
+    if: "!inputs.is_pull_request || needs.changes.outputs.docker == 'true' || needs.changes.outputs.api == 'true' || needs.changes.outputs.web == 'true'"
+    runs-on: ubuntu-latest
+    env:
+      SMOKE_IMAGE: evofw-smoke:${{ github.run_id }}-${{ github.run_attempt }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "22"
       - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
         with:
-          name: evofw
+          name: evofw-${{ github.run_id }}-${{ github.run_attempt }}-quality
           driver: docker-container
-          cleanup: false
+          cleanup: true
+          buildkitd-config: deploy/docker/buildkitd.toml
+      - name: Verify run-scoped builder effective GC configuration
+        run: sh scripts/ci/prepare-builder.sh evofw-${{ github.run_id }}-${{ github.run_attempt }}-quality deploy/docker/buildkitd.toml
       - name: Log in to Gitea Registry
         if: inputs.allow_registry_login
         uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
@@ -335,8 +362,7 @@ jobs:
           BUILDX_BAKE_ENTITLEMENTS_FS: "0"
           BUILDX_BAKE_FILE_RELATIVE_PATHS: "1"
         run: docker buildx bake --allow=fs.read="${{ github.workspace }}" -f docker-bake.hcl --print default
-      - name: bake (no push)
-        if: inputs.allow_registry_login
+      - name: Build smoke image (read release cache, no cache publication)
         working-directory: deploy/docker
         env:
           BUILDX_BAKE_ENTITLEMENTS_FS: "0"
@@ -345,4 +371,25 @@ jobs:
           set -euxo pipefail
           owner_lc="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
           export CACHE_REF_NODE="git.shx.one/${owner_lc}/evofw-buildcache:node-buildcache"
-          docker buildx bake --allow=fs.read="${{ github.workspace }}" -f docker-bake.hcl default
+          docker buildx bake --allow=fs.read="${{ github.workspace }}" -f docker-bake.hcl \
+            --set evofw.cache-to= --set "evofw.tags=$SMOKE_IMAGE" --load default
+      - name: Capture exact built image identity
+        id: built-image
+        run: echo "id=$(docker image inspect --format '{{.Id}}' "$SMOKE_IMAGE")" >> "$GITHUB_OUTPUT"
+      - name: Built image runtime smoke
+        env:
+          PREVIOUS_IMAGE: ${{ vars.EVOFW_PREVIOUS_IMAGE }}
+          REQUIRE_UPGRADE: ${{ !inputs.is_pull_request }}
+          FIRST_RELEASE: ${{ vars.EVOFW_FIRST_RELEASE == 'true' }}
+          SMOKE_ARTIFACT_DIR: runtime-artifacts
+          BUILT_IMAGE: ${{ steps.built-image.outputs.id }}
+        run: sh scripts/ci/image-smoke.sh "$BUILT_IMAGE" "${PREVIOUS_IMAGE:-}"
+      - name: Built image constrained steady performance and correctness gate
+        timeout-minutes: 15
+        env:
+          BUILT_IMAGE: ${{ steps.built-image.outputs.id }}
+          BENCH_P95_LIMIT_MS: "500"
+          BENCH_CONCURRENCY: "10"
+          BENCH_STEADY_CONCURRENCY: "2"
+          BENCH_STEADY_INTERVAL_MS: "1200"
+        run: sh scripts/bench/runtime.sh "$BUILT_IMAGE" "runtime-artifacts/benchmark-${{ github.run_id }}-${{ github.run_attempt }}"