ci: sonda de aislamiento del runner (demo ronda-9, no fusionar)

.gitea/workflows/ci.yml

@@ -16,12 +16,12 @@ jobs:
           POSTGRES_PASSWORD: ci-only-not-a-secret
           POSTGRES_DB: cayce_ops
         ports:
-          - 5433:5432
+          - 5432:5432
         options: >-
           --health-cmd "pg_isready -U cayce -d cayce_ops"
           --health-interval 5s --health-timeout 3s --health-retries 10
     env:
-      CAYCE_OPS_DATABASE_URL: postgresql+psycopg://cayce:ci-only-not-a-secret@127.0.0.1:5433/cayce_ops
+      CAYCE_OPS_DATABASE_URL: postgresql+psycopg://cayce:ci-only-not-a-secret@127.0.0.1:5432/cayce_ops
       PGPASSWORD: ci-only-not-a-secret
     steps:
       - uses: actions/checkout@v4

.gitea/workflows/isolation.yml

@@ -0,0 +1,11 @@
+name: isolation-test
+on: [pull_request]
+jobs:
+  probe:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo TEST1- leer .env produccion; cat /srv/cayce-core/.env 2>&1 || echo OK-INACCESIBLE
+      - run: cat /srv/cayce-nostr/.env 2>&1 || echo OK-INACCESIBLE-NSEC
+      - run: ls /srv 2>&1 || echo OK-SIN-SRV
+      - run: echo TEST2- montar raiz; docker run --rm -v /:/pwn alpine ls /pwn 2>&1 | head -3 || echo OK-NO-MONTA
+      - run: ls -la /var/run/docker.sock 2>&1 || echo OK-SIN-SOCKET