test(ci): prove portfolio runner isolation

.gitea/workflows/release-isolation.yml

@@ -0,0 +1,59 @@
+name: release-isolation-portfolio
+'on':
+  push:
+    branches:
+    - ops/release-isolation-20261112
+jobs:
+  baseline:
+    runs-on: diag-portfolio-runner
+    timeout-minutes: 5
+    steps:
+    - name: Provar isolamento efetivo
+      run: "node <<'JS'\nconst fs = require('node:fs');\nfor (const p of ['/var/run/docker.sock',\
+        \ '/run/docker.sock']) {\n  if (fs.existsSync(p)) throw Error('Docker socket\
+        \ exposto: ' + p);\n}\nif (process.env.DOCKER_HOST) throw Error('DOCKER_HOST\
+        \ exposto');\nconst status = fs.readFileSync('/proc/self/status', 'utf8');\n\
+        const cap = BigInt('0x' + status.match(/^CapEff:\\s*([0-9a-f]+)/m)[1]);\n\
+        const forbidden = [16n, 17n, 19n, 21n].reduce((m,b) => m | (1n << b), 0n);\n\
+        if (cap & forbidden) throw Error('Capacidades privilegiadas expostas');\n\
+        console.log('ISOLATION_OK socket=absent privileged=false runner=' + process.env.RUNNER_NAME);\n\
+        JS\n"
+  privileged:
+    runs-on: diag-portfolio-runner
+    timeout-minutes: 5
+    container:
+      image: docker.gitea.com/runner-images:ubuntu-latest
+      options: --privileged
+    steps:
+    - name: Recusar elevação solicitada pelo workflow
+      run: 'node <<''JS''
+
+        const fs = require(''node:fs'');
+
+        if (fs.existsSync(''/var/run/docker.sock'')) throw Error(''Docker socket exposto'');
+
+        const s = fs.readFileSync(''/proc/self/status'', ''utf8'');
+
+        const cap = BigInt(''0x'' + s.match(/^CapEff:\s*([0-9a-f]+)/m)[1]);
+
+        const forbidden = [16n, 17n, 19n, 21n].reduce((m,b) => m | (1n << b), 0n);
+
+        if (cap & forbidden) throw Error(''Workflow conseguiu --privileged'');
+
+        console.log(''PRIVILEGED_DENIED runner='' + process.env.RUNNER_NAME);
+
+        JS
+
+        '
+  socket-bind:
+    runs-on: diag-portfolio-runner
+    timeout-minutes: 5
+    container:
+      image: docker.gitea.com/runner-images:ubuntu-latest
+      options: --volume=/var/run/docker.sock:/var/run/docker.sock
+    steps:
+    - name: Recusar bind solicitado pelo workflow
+      run: 'node -e "if(require(''node:fs'').existsSync(''/var/run/docker.sock''))throw
+        Error(''Socket bind permitido'');console.log(''SOCKET_BIND_DENIED'')"
+
+        '