test(presentations): qualify isolated Gateway build/render transport

[xnoto]

Summary

First implementation stage of the owner-approved internal presentation MCP design: a disposable, PR-only Jupyter Enterprise Gateway qualification fixture. This does not implement or activate the production MCP adapter.

The 33 additions are confined to .github/tests/presentation-qualification/ and .github/workflows/presentation-qualification.yml. Synthetic one-slide PptxGenJS authoring is followed by bounded, digest-verified channel transport into a fresh rendering kernel, LibreOffice/Poppler conversion, and PNG decoding. Authentication, namespace-scoped RBAC, fixed pod configuration, and cancellation are exercised separately.

Type of change

• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state
• Container image publication
• CI / reusable workflow
• Breaking change

Validation

• Required pull-request checks pass
• Qualification static and runtime checks pass
• No generated or centrally distributed production files changed

CI is the validation environment; no local test or runtime execution is claimed. First execution is this PR CI at commit 97213b8e70d0c0d0f3df72ac4664ebba5d23c341.

Completed-code and infrastructure-security source re-reviews returned ADVANCE with no remaining Critical/High findings after repairs. The CI-integration review remains HOLD for incomplete supplied callee evidence (Medium); its snapshot false-green finding was repaired. QA identified unexecuted CLI/acquisition regression coverage and UID examples as gaps. These are not represented as executed checks. This PR remains draft pending CI and integration follow-up.

Network isolation and overall production qualification remain INCOMPLETE even if core CI passes: default KIND networking does not enforce the supplied static policy example, which is never applied. Snapshot checks observe endpoint metadata only, not transient between-snapshot activity. Mutable apt/npm/pip transitives and runner kubectl are documented fixture-only limitations.

Impact and rollout

Producer: these test-owned files in makeitworkcloud/charts. Consumer: an isolated GitHub-hosted runner and its disposable KIND cluster. Test images are built and loaded locally, never published. No OpenCode chart files, versions, packaged skills, provider configuration, cluster Secrets/PVCs, image pins, or GitOps Applications change.

The existing chart validation workflow is unchanged. Since this diff changes only .github, changed-chart detection selects no chart: no OCI publication or automatic OpenCode GitOps-pin update is intended. Authored/committed is the current stage; CI validation is automatic on this PR. Production backend publication, selection, reconciliation, health, and actual provider image-review acceptance remain separate, confirmation-gated work.

Rollback: reviewed revert of the fixture/workflow; no production rollout or database rollback. No merge, package publication, workflow dispatch, or deployment is authorized by opening this PR.

Safety and secrets

• Contains no plaintext production secrets, decrypted SOPS values, state files, kubeconfigs, credentials, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed
• Breaking or irreversible effects and remaining gates are described above

Synthetic runtime authentication only. No raw gateway/kernel logs, environments, kubeconfigs, or connection material are printed or uploaded. Snapshot persistence projects namespace/name/UID only. Explicit disposable kubeconfig/context, restrictive file creation, and exit cleanup are used.

Materially AI-authored. No runtime containment, deck-quality, Office-fidelity, licensing-complete helper packaging, provider-visible preview, production artifact export, or multi-tenant authorization qualification is claimed.

[github-actions]

Chart CI passed

Repository hygiene and Helm validation passed. View the workflow run.

[xnoto]

Initial CI — failed; runtime not executed

At head 97213b8e70d0c0d0f3df72ac4664ebba5d23c341, fixture CI failed its static job (128 tests; one error and one failure), so runtime qualification was skipped. Repository CI failed hygiene: multi-document YAML and synthetic bad-token curl-header literals. Helm validation succeeded; changed-chart detection succeeded; package publication and GitOps updater jobs were skipped.

Repairs are being authored for the missing same-parent build-status fixture, comment-sensitive assertion, single-document Kubernetes List packaging, and dynamically generated unauthorized test tokens. No secret-scanner exemption, dispatch, production mutation, or runtime pass is claimed. PR stays draft. Network and overall qualification remain INCOMPLETE.

[xnoto]

Initial CI repairs are committed in ac30d49. Both completed-code and security review of the five-file repair returned ADVANCE with no Critical/High findings. The automatic PR checks are being monitored at this new head. No manual workflow dispatch or scanner exemption was used.

The initial failed iteration still establishes no runtime proof. Draft status and network/overall INCOMPLETE boundaries remain unchanged pending current-head CI and integration follow-up.

[xnoto]

Second iteration: static and repository checks passed; runtime failed before build

At ac30d4917c965b98f72387246569d0fc2dfd51c6, all 128 fixture unit tests and repository hygiene/Helm checks passed. Runtime executed but stopped at its client/server skew guard: the hosted runner supplied kubectl 1.37 against the fixture node 1.33. No image build or kernel execution occurred in that run.

a23b2a8 now selects the existing checksum-verified download path for kubectl 1.33.4, matching the node. Its SHA-256 was verified against the official dl.k8s.io checksum; README updated. Automatic current-head CI is being monitored. No manual dispatch, merge, image publication, or deployment occurred; draft status and production gates remain unchanged.

[xnoto]

Pinned-client iteration: runtime readiness failure

All checks at a23b2a833c5cd44eab7e6cc9e4a443759630cb93 are terminal: fixture static tests and repository checks passed; runtime qualification executed and failed with gateway API never became ready. Packaging and the GitOps updater were skipped.

The underlying cause is not established by that message. A narrow diagnostic change is under source review: bounded HTTP status, port-forward liveness, and sanitized pod status reason/count projections only. No gateway/kernel logs, environments, credentials, response bodies, pod specifications, or raw port-forward output will be retrieved. No auth/RBAC/resource workaround is being made without evidence. No core pass or executed network verdict is claimed; PR remains draft.