[rmcdaniel]

Verify pip trust before CI dependency installs

Refs durable-workflow/.github#237. Add the reviewed immutable pip bootstrap before policy dependencies, preserving application runtime, packages, protocol fixtures and job budgets.

The first candidate's unit-contract job failed at SqliteDatabaseAcknowledgementTest::testChangedQueueAndReservationTimestampAreAlsoFenced (522 tests / 2,765 assertions, one failure). Its fixture computes time()+1 before creating the reservation. If the clock advances, the supposed replacement timestamp can equal the newly reserved timestamp, so valid deletion fails the fixture's assertion.

A deterministic one-second clock-boundary control reproduces that exact null assertion on the old test. The corrected fixture derives a distinct timestamp from the stored original and verifies the entire changed row survives. It passes the controlled boundary (four assertions) and the full acknowledgement class (14 tests / 78 assertions) on PHP 8.3.36 / Laravel 13.34.0 with the unchanged candidate runtime source. No production queue/fence code changes, retries, handler replay or old-result rescue are included. The original CI remains failed; fresh normal qualification is required.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Delivered through the normal protected merge at 33f556f. Whole tree f18163666ff4e0749965c749d0fbceaecd69a591 exactly matches qualified 32f4046. All 16 applicable checks pass with six explicit skips; the current Sonar report has zero new/accepted issues. Remote branch deletion is verified by the ref API returning 404. This changes CI and the deterministic acknowledgement-test fixture, with no runtime, package version or release change. Existing failed observations remain on their original runs. The separate protected policy issuer and organization rollout remain open under shared #237.