refactor: remove CI.json from G14 CI

scripts/validate-runtime-boundary.mjs

@@ -236,7 +236,7 @@ function assertDurableRuntimeRunbook(value) {
   }
 }
 
-function assertCloudApiImageRuntimeEntrypoints({ packageJson, ciJson, artifactPublisher, gitopsRenderSource }) {
+function assertCloudApiImageRuntimeEntrypoints({ packageJson, artifactPublisher, gitopsRenderSource }) {
   const label = "cloud-api image runtime maintenance entrypoints";
   for (const expected of [
     "COPY internal ./internal",
@@ -256,11 +256,9 @@ function assertCloudApiImageRuntimeEntrypoints({ packageJson, ciJson, artifactPu
   for (const expected of ["scripts/g14-artifact-publish.mjs", "runtime-dev", "runtime-prod"]) {
     assertIncludes(gitopsRenderSource, expected, `${label} G14 GitOps render source`);
   }
-  assert.equal(
-    ciJson.commands?.some((command) => command.id === "g14-contract-check"),
-    true,
-    `${label} CI must run the G14 contract check`
-  );
+  for (const expected of ["name: \"prepare-source\"", "name: \"repo-reports-guard\"", "name: \"g14-contract-check\"", "name: \"codex-api-forwarder-check\""]) {
+    assertIncludes(gitopsRenderSource, expected, `${label} Tekton primitive CI task`);
+  }
 }
 
 function assertGuardFixture(guard) {
@@ -357,12 +355,21 @@ function assertWorkloads(workloads, guard) {
     assertTemplateServiceId(workload, serviceId, `workload ${serviceId}`);
 
     const containers = containerList(workload, `workload ${serviceId}`);
-    assert.equal(containers.length, 1, `${serviceId} workload must have one container`);
-    const container = containers[0];
-    assert.equal(container.name, serviceId, `${serviceId} container name`);
-    assertHwlabImage(container.image, serviceId, `${serviceId} container`);
-    assertHealthProbe(container, serviceId, `${serviceId} container`);
-    assertNoForbiddenSubstitutesDeep(container.env ?? [], `${serviceId} container env`);
+    assert.ok(containers.length >= 1, `${serviceId} workload must define at least one container`);
+    assertUnique(
+      containers.map((container) => container.name),
+      `${serviceId} container names`
+    );
+
+    const primaryContainer = containers.find((container) => container.name === serviceId);
+    assert.ok(primaryContainer, `${serviceId} workload must include primary container ${serviceId}`);
+
+    for (const container of containers) {
+      assertHwlabImage(container.image, serviceId, `${serviceId} container ${container.name}`);
+      assertNoForbiddenSubstitutesDeep(container.env ?? [], `${serviceId} container ${container.name} env`);
+    }
+
+    assertHealthProbe(primaryContainer, serviceId, `${serviceId} container ${serviceId}`);
   }
 }
 
@@ -442,7 +449,6 @@ assertProdDisabled(
 assertDurableRuntimeRunbook(await readText("docs/reference/dev-runtime-boundary.md"));
 assertCloudApiImageRuntimeEntrypoints({
   packageJson: await readJSON("package.json"),
-  ciJson: await readJSON("CI.json"),
   artifactPublisher: await readText("scripts/artifact-publish.mjs"),
   gitopsRenderSource: await readText("scripts/g14-gitops-render.mjs")
 });