ci: gate deployment on offline chat qualification

.gitea/workflows/rebuild.yml

@@ -9,6 +9,26 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+      - name: Qualify offline account and chat contracts before building or deploying
+        run: |
+          # No NAS, speech SDK, model calls or legacy live-default conftest.
+          # Read-only source mount; test secrets and databases use container /tmp.
+          docker run --rm --user "$(id -u):$(id -g)" \
+            -e HOME=/tmp -e PYTHONDONTWRITEBYTECODE=1 \
+            -v "$PWD:/src:ro" -w /src python:3.12-slim-bookworm \
+            sh -eu -c '
+              python -m venv /tmp/offline-tests
+              /tmp/offline-tests/bin/python -m pip install --no-cache-dir pytest pytest-asyncio -r control/requirements.txt
+              /tmp/offline-tests/bin/python scripts/generate_hope_themes.py --check
+              /tmp/offline-tests/bin/python -m pytest --noconftest -p no:cacheprovider \
+                tests/unit/test_accounts.py tests/unit/test_provisioner.py \
+                tests/unit/test_token_bootstrap.py tests/unit/test_deploy_rollback.py \
+                tests/unit/test_model_preferences_store.py tests/unit/test_model_settings_api.py \
+                tests/unit/test_chat_store.py tests/unit/test_chat_runs.py \
+                tests/unit/test_chat_api.py tests/unit/test_chat_exports.py \
+                tests/unit/test_chat_features.py tests/unit/test_chat_security_review.py \
+                tests/unit/test_chat_cross_client.py -q
+            '
       - name: Build images
         run: |
           docker build -t hope-voice-api-voice:latest .