ci(release): add runtime builder runner workflow

tests/unit/test_release_scripts.py

@@ -154,6 +154,18 @@ def test_subscription_api_is_not_wired_to_ui_until_backend_exists():
     assert importers == []
 
 
+def test_gitea_production_deploy_requires_runtime_builder_job():
+    workflow = Path(".gitea/workflows/deploy.yml").read_text(encoding="utf-8")
+    build_section = workflow.split("build-production-runtime-images:", 1)[1].split("deploy-production:", 1)[0]
+    production_section = workflow.split("deploy-production:", 1)[1]
+
+    assert "runs-on: runtime-builder" in build_section
+    assert "scripts/build_release_images.sh \"${GITHUB_REF_NAME}\"" in build_section
+    assert "PRODUCTION_SSH_HOST" in build_section
+    assert "runtime-images-${GITHUB_REF_NAME}.tar" in build_section
+    assert "needs: build-production-runtime-images" in production_section
+
+
 def test_build_host_runbook_requires_off_production_runtime_builds():
     runbook = Path("docs/BUILD-HOST-RUNBOOK.md").read_text(encoding="utf-8")
 
@@ -164,6 +176,17 @@ def test_build_host_runbook_requires_off_production_runtime_builds():
     assert "python scripts/smoke_public_upload_flow.py" in runbook
 
 
+def test_runtime_builder_runner_runbook_matches_workflow():
+    runbook = Path("docs/GITEA-RUNTIME-BUILDER-RUNNER.md").read_text(encoding="utf-8")
+
+    assert "runs-on: runtime-builder" in runbook
+    assert "PRODUCTION_SSH_HOST" in runbook
+    assert "PRODUCTION_SSH_USER" in runbook
+    assert "PRODUCTION_SSH_KEY" in runbook
+    assert "Do not install this runner on the current production host" in runbook
+    assert "production deploy waits for the image job" in runbook
+
+
 def test_deployment_docs_forbid_production_runtime_builds():
     docs = Path("docs/DEPLOYMENT.md").read_text(encoding="utf-8")