fix(deploy-epoch): un-spoofable smoke gates + honest docs (deploy-epoch-fix) (#29)

Co-authored-by: Aaron D. Lee <himself@adlee.work>
Co-committed-by: Aaron D. Lee <himself@adlee.work>

.github/workflows/ci.yml

@@ -40,7 +40,9 @@ jobs:
           --health-timeout 5s
           --health-retries 3
     env:
-      VALKEY_URL: redis://127.0.0.1:6379/
+      # Service-name form: act_runner hosts jobs in a separate netns —
+      # loopback doesn't reach the valkey service container.
+      VALKEY_URL: redis://valkey:6379/
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -67,7 +69,9 @@ jobs:
       matrix:
         toolchain: [stable, "1.85"]
     env:
-      VALKEY_URL: redis://127.0.0.1:6379/
+      # Service-name form: act_runner hosts jobs in a separate netns —
+      # loopback doesn't reach the valkey service container.
+      VALKEY_URL: redis://valkey:6379/
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/publish-images.yml

@@ -62,6 +62,24 @@ jobs:
     strategy:
       matrix:
         toolchain: [stable, "1.85"]
+    # T9: service container block mirrors ci.yml's test job (post-T1 form).
+    # Without this, the valkey_sink_lifecycle test self-skips on every v* tag
+    # (the tag-gate promise: "byte-identical to the image CI tested" — silent
+    # skip on a non-running test is the silent-skip failure mode the T1 fix
+    # was specifically about). Service-name VALKEY_URL matches T1: act_runner
+    # hosts jobs in a separate netns, loopback doesn't reach the service.
+    services:
+      valkey:
+        image: valkey/valkey:latest
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "valkey-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 3
+    env:
+      VALKEY_URL: redis://valkey:6379/
     steps:
       - uses: actions/checkout@v4