build: the gate is scripts/check.sh, and CI goes

The Gitea Actions gate repeated, after the merge, what a release already runs
before it, and its runner shared the git host's container: one run there
starved Gitea of memory until it stopped answering. The lanes now live in
scripts/check.sh, run the same by the release dispatcher and by hand, and the
gate-contract test holds its lines (the ruff and pip-audit checks read it
instead of the workflow). The two audits only CI ran join the gate: pip-audit
over the lock (pinned in the test image, blocking at any severity) and npm
audit of the production dependencies. The engine contracts drop the CI
containers; the register records that pushes have no server-side gate.

frontend/src/lib/pythonEngine.contract.test.ts

@@ -11,12 +11,12 @@ import { expect, it } from "vitest";
 //
 // It lives in the FRONTEND suite for one boring reason: this is the only runner that can see the
 // whole repository. The backend suite runs inside the test image, which mounts `backend/` alone, so
-// it cannot read the repo-root Dockerfile or the workflow. It holds the other half of the chain —
+// it cannot read the repo-root Dockerfile. It holds the other half of the chain —
 // including "the interpreter running these tests IS the pinned one", which only it can assert:
 //
 //   backend/tests/test_python_engine_contract.py :  running interpreter == pyrightconfig == ruff.toml
 //   here                                         :  .python-version == pyrightconfig == ruff.toml
-//                                                   == Dockerfile == Dockerfile.test == check.yml
+//                                                   == Dockerfile == Dockerfile.test
 //
 // To move the version: edit `.python-version`, then follow the failures in both files.
 const readRoot = (rel: string) => readFileSync(new URL(`../../../${rel}`, import.meta.url), "utf8");
@@ -55,18 +55,6 @@ it("tests on the pinned version", () => {
   ).toBe(pinned);
 });
 
-it("runs the server gate on the pinned version", () => {
-  // The backend job's container. Its NODE is deliberately outside the Node contract (it only runs
-  // the checkout action), but its PYTHON runs our code and our tests, so it is inside this one.
-  expect(
-    versionIn(
-      readRoot(".gitea/workflows/check.yml"),
-      /^\s*container: nikolaik\/python-nodejs:python(\d+)\.(\d+)-nodejs\d+$/m,
-      "check.yml",
-    ),
-  ).toBe(pinned);
-});
-
 it("type-checks against the pinned version", () => {
   // A type checker aimed at another version green-lights APIs the shipped interpreter does not have
   // — the same defect as the image split, moved to check time.