ci: wheel/package are blocking — runner egress proven on the v0.1.0 tag pipeline

Pipeline 6999 built the openziti 1.7.1 wheel (github.com + pypi.org) and the
nfpm .deb; the allow_failure escape hatches are no longer honest. package now
requires the wheel so a .deb can never ship without transport sdk.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1

.gitlab-ci.yml

@@ -3,9 +3,8 @@
 #   lint -> test -> build (openziti wheel) -> package (.deb via nfpm) -> release (v* tags) -> docs
 #
 # Every script line is single-quoted (a bare ": " turns the line into a YAML map and silently
-# yields a 0-job pipeline). Jobs that need egress the runner may not have (GitHub for the
-# openziti sdist's ziti-sdk-c fetch, GitHub for the nfpm binary) are allow_failure: true until
-# proven; see README "CI notes".
+# yields a 0-job pipeline). Runner egress to github.com + pypi.org was PROVEN on the v0.1.0 tag
+# pipeline (6999: openziti 1.7.1 wheel built, nfpm .deb packaged), so wheel/package are blocking.
 #
 # CI/CD variables (project or group level):
 #   GITEA_TOKEN   — Gitea API token (write:repository) for `release:gitea`; without it the job is manual
@@ -76,13 +75,11 @@ test:
 # PyPI ships `openziti` as an sdist whose build fetches ziti-sdk-c (+ prebuilt tlsuv/uv-mbed
 # via cmake FetchContent) from github.com at install time. Building it here on ubuntu:26.04
 # (the target OS; python3 = the target's python3) gives us a wheel to vendor into the venv.
-# NEEDS runner egress to github.com + pypi.org; allow_failure until proven on this runner —
-# without the wheel the .deb still builds (transports proxy/system work; sdk logs a clear error).
+# NEEDS runner egress to github.com + pypi.org (proven 2026-09-05, pipeline 6999).
 wheel:
   stage: build
   image: ubuntu:26.04
   needs: ["test"]
-  allow_failure: true
   rules:
     - if: '$CI_COMMIT_TAG'
     - if: '$CI_COMMIT_BRANCH == "main"'
@@ -104,15 +101,14 @@ wheel:
 # --- the .deb --------------------------------------------------------------------------------------
 # venv at its final path (/opt/monky-deployd/venv is where the .deb puts it; venvs are not
 # relocatable) + nfpm. nfpm comes from GitHub releases (egress) with the goreleaser apt repo as
-# fallback; allow_failure until proven.
+# fallback (proven 2026-09-05, pipeline 6999). The wheel is required: a .deb without it would
+# silently ship a broken `transport: sdk`.
 package:
   stage: package
   image: ubuntu:26.04
   needs:
     - job: test
     - job: wheel
-      optional: true
-  allow_failure: true
   rules:
     - if: '$CI_COMMIT_TAG'
     - if: '$CI_COMMIT_BRANCH == "main"'
@@ -127,7 +123,9 @@ package:
     - 'python3 -m venv /opt/monky-deployd/venv'
     - '/opt/monky-deployd/venv/bin/pip install -q --upgrade pip'
     - '/opt/monky-deployd/venv/bin/pip install -q .'
-    - 'if ls vendor/*.whl >/dev/null 2>&1; then /opt/monky-deployd/venv/bin/pip install -q vendor/*.whl && /opt/monky-deployd/venv/bin/python -c "import openziti; print(\"openziti\", openziti.__version__ if hasattr(openziti, \"__version__\") else \"ok\")"; else echo "WARNING: no vendored openziti wheel — transport sdk will not work from this build"; fi'
+    - 'ls vendor/*.whl >/dev/null 2>&1 || { echo "no vendored openziti wheel (wheel job artifact missing)"; exit 1; }'
+    - '/opt/monky-deployd/venv/bin/pip install -q vendor/*.whl'
+    - '/opt/monky-deployd/venv/bin/python -c "import openziti; print(\"openziti import ok\")"'
     - '/opt/monky-deployd/venv/bin/python -m monky_deployd version'
     - 'mkdir -p build dist && cp -a /opt/monky-deployd/venv build/venv'
     # nfpm: GitHub release .deb, else the goreleaser apt repo