Fail closed on skipped container integration

[Chris0Jeky]

Summary

• make Docker unavailability a test failure only when the caller explicitly requests Docker-backed coverage
• add a reusable-workflow negative control that forces Docker unavailable and verifies the specific failure through TRX
• require the hosted positive TRX to contain zero skipped tests and at least 28 passing PostgreSQL-backed results

Implementation notes

Ordinary Dockerless runs keep the existing graceful-skip path. The reusable Ubuntu workflow sets TASKDECK_REQUIRE_DOCKER=true; a forced-unavailable process is expected to fail before the real Docker-backed run.

Tests

• py -3 -B -m unittest scripts/ci/test_assert_container_integration_results.py — 5 passed
• Docker-required negative control — 5 failed as expected; TRX contract verifier passed
• Dockerless integration project — 7 passed / 28 skipped / 0 failed; positive verifier rejected it as expected
• node scripts/check-github-ops-governance.mjs — passed
• Git Bash shell syntax canary — passed
• Real Dockerless TRX classification — 35 total, 28 PostgreSQL, 1 host-native SQLite; SQLite excluded from the PostgreSQL minimum
• Exact-head hosted Container Integration (PostgreSQL) — passed, including positive PostgreSQL startup/migrations/tests/teardown
• Exact-head hosted rollup — 36 successes / 5 intentional skips / 0 pending / 0 failed
• DCO trailers — 3/3 commits

Docs

docs/TESTING_GUIDE.md now records the hosted required-mode flag, forced-unavailable negative control, and positive TRX zero-skip/minimum-PostgreSQL contract. docs/STATUS.md and docs/IMPLEMENTATION_MASTERPLAN.md remain unchanged because this PR is not yet shipped.

Verification boundary

Local Docker Desktop's Linux engine was unavailable, so local positive container startup was not verified. The equivalent exact-head hosted Container Integration job passed and is the authoritative positive PostgreSQL proof. The local full backend run had one unrelated nondeterministic SignalR stress-test failure; its focused rerun passed, and the exact recurrence was recorded on existing owner #1521.

Closes #1520

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 04438ade4e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Fresh-context adversarial review of exact head 5f721ca: no remaining CRITICAL/HIGH findings. The forced-unavailable path is process-scoped and verifies the intended failure in TRX; the positive parser requires zero skips and at least 28 PostgreSQL-backed results while excluding fixture infrastructure and SQLiteNativeVersionTests; the new 27-PostgreSQL-plus-SQLite canary closes the earlier false-green. The hosted positive container job remains the required runtime evidence before owner merge.