diff --git a/.gitea/workflows/quality.yml b/.gitea/workflows/quality.yml
index 7ce6586..ed08be5 100644
--- a/.gitea/workflows/quality.yml
+++ b/.gitea/workflows/quality.yml
@@ -11,14 +11,17 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Secret scan
-        uses: trufflesecurity/trufflehog@v3.79.0
-        with:
-          path: ./
-          extra_args: --only-verified
+        shell: bash
+        run: |
+          set -euo pipefail
+          scan_container="$(docker create ghcr.io/trufflesecurity/trufflehog:3.79.0 filesystem /scan --only-verified --fail --no-update)"
+          trap 'docker rm -f "${scan_container}" >/dev/null 2>&1 || true' EXIT
+          tar --exclude=.git --transform='s#^\.$#scan#;s#^\./#scan/#' -cf - . | docker cp - "${scan_container}:/"
+          docker start -a "${scan_container}"
 
   quality:
-    # Node, Playwright and the browser gate are supported by the shared Linux pool.
-    runs-on: ubuntu-latest
+    # Browser quality runs against the dedicated bounded Windows 11 VM runner.
+    runs-on: windows-native
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -27,7 +30,7 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run quality
-      - run: npx playwright install --with-deps chromium
+      - run: npx playwright install chromium
       - run: npm run test:browser:ci
       - name: Preserve browser failure evidence
         if: failure()
diff --git a/tests/repository-monitor.test.mjs b/tests/repository-monitor.test.mjs
index 52062e1..cf99abc 100644
--- a/tests/repository-monitor.test.mjs
+++ b/tests/repository-monitor.test.mjs
@@ -85,6 +85,10 @@ test('a watched repository is read on filesystem activity instead of on every in
 
   revision = 2;
   await writeFile(path.join(root, 'feature.txt'), 'changed\n');
+  // Exercise the monitor's filesystem-activity boundary deterministically.
+  // Native fs.watch delivery is platform/overlay specific and is covered by
+  // the product's safety interval rather than by this unit test.
+  monitor.noteFilesystemChange(root);
   // The watcher debounce and the per-repository cooldown both apply here.
   const deadline = Date.now() + 5_000;
   while (changes.length === 0 && Date.now() < deadline) {