mathiasandClaude Opus 5
2f53346b8c
infra#368 added jq to the gitea-runner image on the stated grounds that check-mcp-env would then verify in CI instead of skipping. Verified after rolling baked-v16: jq IS present now, the `SKIP: jq not installed` branch is gone -- and the check still reports unverified, because CI has no ~/.op-env. The env-file branch was always the binding one. It holds live credentials, so it is not on the runner and must not be, which means this check can only ever verify on a host that has one. Putting ~/.op-env on the runner to turn the NOTE green would be trading a real secret for a green tick. So the message now says so, at the point someone reads it. The risk otherwise is not the skip -- it is a future reader seeing a passing pipeline and concluding the MCP wiring is covered. It is covered on developer hosts only. jq was still worth adding: it is a genuine dependency of this checker, the runner's tool-contract.txt now asserts it, and a future image built without it is a red pod at roll time rather than a silently degraded check. Bump-Type: patch Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>