ci: a failing lane must not publish an image

build gated on lint + typecheck only, so run 4293 failed its test lane and
pushed :dev and :09b5f87 regardless — the deployed server was running a
build whose tests were red.

The comment justified this by saying DB-backed testing happened manually
against the dev image rather than on every push. That was true when it was
written and stopped being true at 6f21db8, which added the integration
lane. The reason went away; the exception didn't.

Gate on test and integration too. A :<sha> image is the rollback unit for
its commit (family rule 46) — one publishable from a failing run is not
something you can roll back to.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -193,8 +193,7 @@ jobs:
   # them ever executed by CI — and the schema the migrations build had never been
   # checked against the models that read it.
   #
-  # Runs for visibility and does NOT gate the build, matching the `test` lane and
-  # FabledScribe's equivalent job.
+  # Gates the build, along with every other lane — see the `build` job's `needs`.
   #
   # Job key stays separator-free ("integration") with no `name:` — rule 80. act_runner
   # derives the service-container name from the truncated job display name, and the
@@ -261,10 +260,16 @@ jobs:
 
   build:
     name: Build & push image
-    # Build gates on lint + typecheck. The `test` job runs in parallel for
-    # visibility but does not block dev image builds (DB-backed integration
-    # testing happens against the dev image manually, not on every push).
-    needs: [gate, typecheck, lint]
+    # Every lane gates the build. This once stopped at lint + typecheck, on the
+    # reasoning that DB-backed testing happened manually against the dev image
+    # rather than on every push — true until 6f21db8 added the integration lane,
+    # and false since.
+    #
+    # What that gap cost: run 4293 failed `test` and published :dev and :<sha>
+    # anyway, so the deployed server ran a build whose test lane was red. An image
+    # tag is the rollback substrate (family rule 46); one that can be published
+    # from a failing run is not a substrate you can roll back TO.
+    needs: [gate, typecheck, lint, test, integration]
     if: needs.gate.outputs.build == 'true'
     runs-on: python-ci
     container: