fix(ci): restore exact AI release evidence gates

.gitea/workflows/managed-validation.yml

@@ -20,7 +20,9 @@ concurrency:
 
 jobs:
   full:
-    name: ${{ inputs.profile || 'full' }}
+    # Gitea Actions does not consistently evaluate the GitHub-style `||`
+    # expression for pull-request runs without workflow inputs.
+    name: Managed repository validation
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:

.gitea/workflows/release-gates.yml

@@ -61,7 +61,9 @@ jobs:
           docker compose config > artifacts/docker-compose.resolved.yml
       - name: Publish quality evidence
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        # Gitea Actions currently exposes the GHES-compatible artifact API;
+        # upload-artifact v4 deliberately refuses that API.
+        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de # v3.2.2-node20
         with:
           name: quality-evidence
           path: |
@@ -98,7 +100,7 @@ jobs:
           npm audit --audit-level=high --json > ../artifacts/npm-audit.json
       - name: Publish dependency evidence
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de # v3.2.2-node20
         with:
           name: dependency-audits
           path: |
@@ -135,6 +137,9 @@ jobs:
       - name: Generate SPDX SBOM
         env:
           RELEASE_SHA: ${{ gitea.sha }}
+          GEOINTEL_IMAGE_ARCHIVE: artifacts/geointel-image.tar
+          GEOINTEL_KEEP_IMAGE_ARCHIVE: "true"
+          SYFT_PARALLELISM: "1"
         run: |
           IMAGE_ID="$(cat artifacts/image-id.txt)"
           test "$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")" = "$IMAGE_ID"
@@ -142,14 +147,22 @@ jobs:
       - name: Enforce container vulnerability policy
         env:
           RELEASE_SHA: ${{ gitea.sha }}
+          GEOINTEL_IMAGE_ARCHIVE: artifacts/geointel-image.tar
+          GEOINTEL_KEEP_IMAGE_ARCHIVE: "true"
         run: |
           IMAGE_ID="$(cat artifacts/image-id.txt)"
           test "$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")" = "$IMAGE_ID"
           bash scripts/scan_container_image.sh "$IMAGE_ID"
           test "$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")" = "$IMAGE_ID"
+      - name: Remove temporary image archive
+        if: always()
+        run: >-
+          rm -f -- artifacts/geointel-image.tar
+          artifacts/geointel-image.tar.image-id
+          artifacts/geointel-image.tar.partial.*
       - name: Publish container evidence
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de # v3.2.2-node20
         with:
           name: container-evidence
           path: |