Live E2E: nothing pins the key gates, so a step that maps the secret can run ungated #811

What happened

Reviewer2's negative control on #30 (b6cdfbd1) found the hole: deleting if: from Run the four checks in .github/workflows/live-e2e.yml leaves all four new tests green. The invariant "a keyless run touches nothing that needs the key" is real in the workflow and is checked by nobody but the person reading the diff.

#30's own tests cover the preflight script and the skip path. They do not read the workflow text, so a later edit — dropping an if:, or adding a step that maps the secret — changes what a keyless run does and CI says nothing. The failure direction today is a red step rather than a silent pass, which is why this is not urgent; it is still an invariant with no test behind it.

The inventory to pin, at 6f9b60c7 (live-e2e.yml blob 083bf76d)

The six key-consuming steps that do not map the secret themselves are gated the same way: npm ci (core) (94), Install the pinned DSH runtime (99), Clone DeepSeek Harness at the pinned tag (107), Start the usage tap (114), Start the real-model bench (126), Run the four checks (133), plus Stop the bench and the tap (144).

Acceptance

A test in .github/scripts/test-workflow.test.mjs — the file that already asserts workflow text — reading .github/workflows/live-e2e.yml as text and asserting, per step block (split on step boundaries; an if: in a neighbouring step must not satisfy this one):

1. Every step whose env: maps secrets. carries a non-empty if:, except the step whose id: is preflight.
2. Each such if: names steps.preflight.outputs.key.
3. The seven key-consuming steps listed above carry the same if: (or, for Stop the bench and the tap, always() && steps.preflight.outputs.key == 'true').
4. The preflight step itself is still unconditional — a regexp that requires an if: on every secret-bearing step must exempt it by id, never by the display name.

The test must be shown failing on all five of these edits, one at a time, in the pull request:

• delete if: from Run the four checks → red, naming that step;
• delete if: from Start the real-model bench → red;
• delete if: from npm ci (core) → red;
• add a step with env: { DEEPSEEK_API_KEY: ${{ secrets.ANYTHING }} } and no if: → red;
• put any if: on the preflight step → red.

Kill conditions

• The test passes while any one of those five edits is applied.
• The exemption is keyed on the step's display name, or on being the first step, instead of id: preflight.
• A YAML parser is added as a dependency, or the assertion is a single regexp over the whole file rather than over each step block.
• live-e2e.yml itself is changed in the same pull request. This pins what exists; a workflow change is its own issue.

Out of scope

Adding a real DEEPSEEK_API_KEY or making a keyless run count as verification (that is #794 and it stays needs-human); the preflight script's own behaviour (.github/scripts/live-e2e-preflight.test.mjs already covers it); the four E2E checks; any other workflow.