fix: enforce sandbox execution boundary

.forgejo/workflows/ci-smoke.yaml

@@ -1,27 +1,53 @@
-name: CI Smoke
+# Forgejo Actions CI for glas-harness.
+# ubuntu-latest maps to a minimal node:20-bookworm runner, so use archive
+# checkout and install Python explicitly. sand-boxer is a sibling source
+# dependency and is fetched separately for contract tests.
+name: ci
 
 on:
   push:
-    branches:
-      - main
+    branches: [main]
+  pull_request:
+    branches: [main]
   workflow_dispatch:
 
 jobs:
-  host-smoke:
-    runs-on: self-hosted
-    steps:
-      - name: Routing probe (host runner)
-        run: |
-          set -eu
-          echo "repository=${GITHUB_REPOSITORY:-unknown}"
-          echo "sha=${GITHUB_SHA:-unknown}"
-          echo "runner=${RUNNER_NAME:-unknown}"
-          uname -a
-
-  container-smoke:
+  validate:
     runs-on: ubuntu-latest
     steps:
-      - name: Routing probe (container label)
+      - name: Fetch glas-harness source archive
+        env:
+          REF: ${{ github.sha }}
         run: |
           set -eu
-          echo "glas-harness container-smoke ok"
+          SHORT="${REF:0:7}"
+          mkdir -p /tmp/glas-harness
+          wget -qO /tmp/glas-harness.tar.gz \
+            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
+          tar xzf /tmp/glas-harness.tar.gz -C /tmp/glas-harness --strip-components=1
+
+      - name: Fetch sand-boxer contract dependency
+        run: |
+          set -eu
+          mkdir -p /tmp/sand-boxer
+          wget -qO /tmp/sand-boxer.tar.gz \
+            "https://forgejo.coulomb.social/coulomb/sand-boxer/archive/main.tar.gz"
+          tar xzf /tmp/sand-boxer.tar.gz -C /tmp/sand-boxer --strip-components=1
+
+      - name: Install Python and packages
+        working-directory: /tmp/glas-harness
+        run: |
+          set -eu
+          apt-get update -qq
+          apt-get install -y -qq python3 python3-pip python3-venv >/dev/null
+          python3 -m pip install --break-system-packages --upgrade pip
+          python3 -m pip install --break-system-packages /tmp/sand-boxer
+          python3 -m pip install --break-system-packages ".[dev]"
+
+      - name: Run unit and boundary tests
+        working-directory: /tmp/glas-harness
+        run: python3 -m pytest tests/ -q
+
+      - name: Validate packaged execution catalog
+        working-directory: /tmp/glas-harness
+        run: glas-harness profiles