ci(TC-887): resolve the w5 workspace with --locked using a policy-engine deploy key

.github/workflows/rust.yml

@@ -304,3 +304,64 @@ jobs:
         if [ -f "$TC887_STATE" ]; then
           bash scripts/at-rest-harness/harness.sh down --purge "$TC887_STATE"
         fi
+
+  # TC-887: test/w5-policy-runtime-node-e2e depends on the private
+  # TinyCloudLabs/policy-engine repository by git, so the workflow token cannot
+  # resolve it. With a read-only deploy key for that one repository in the
+  # POLICY_ENGINE_DEPLOY_KEY secret, this job resolves w5 with --locked like
+  # the other workspaces. The key is loaded into an ssh-agent for the cargo
+  # step only and removed from the environment before cargo runs; checkout
+  # keeps no credentials.
+  # Without the secret the job skips with a notice. That is intended for fork
+  # PRs, which never receive secrets, and for the period before the deploy key
+  # exists. Once the key is added, pushes and same-repository PRs are meant to
+  # fail when the secret is missing; only fork PRs keep the notice skip.
+  w5-lockfile:
+    name: w5 workspace lockfile (private dependency)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    env:
+      HAS_DEPLOY_KEY: ${{ secrets.POLICY_ENGINE_DEPLOY_KEY != '' }}
+    steps:
+    - name: Skip without the policy-engine deploy key
+      if: env.HAS_DEPLOY_KEY != 'true'
+      run: echo "::notice title=w5 lockfile not checked::POLICY_ENGINE_DEPLOY_KEY is not available (fork PR, or the key is not added yet); the w5 --locked resolve was skipped."
+    - name: Checkout TinyCloud repository
+      if: env.HAS_DEPLOY_KEY == 'true'
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    # No toolchain action: rustup on the runner installs the toolchain pinned
+    # in rust-toolchain.toml when cargo first runs.
+    - name: Resolve w5 with --locked
+      if: env.HAS_DEPLOY_KEY == 'true'
+      env:
+        POLICY_ENGINE_DEPLOY_KEY: ${{ secrets.POLICY_ENGINE_DEPLOY_KEY }}
+        CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+      run: |
+        set -euo pipefail
+        lock=test/w5-policy-runtime-node-e2e/Cargo.lock
+        repo=https://github.com/TinyCloudLabs/policy-engine
+        # The rewrite below is a git prefix match. Anchor it: every lockfile
+        # source under that prefix must be exactly this repository (followed
+        # by its ?query or #revision), so no other URL can be rewritten.
+        if grep -E "^source = \"git\+${repo}[^?#\"]" "$lock"; then
+          echo "::error::$lock has a git source that shares the ${repo} prefix but is a different URL"
+          exit 1
+        fi
+        eval "$(ssh-agent -s)" > /dev/null
+        trap 'ssh-agent -k > /dev/null' EXIT
+        ssh-add - <<< "$POLICY_ENGINE_DEPLOY_KEY"
+        unset POLICY_ENGINE_DEPLOY_KEY
+        # GitHub's published ED25519 host key:
+        # https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints
+        mkdir -p ~/.ssh
+        echo "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl" >> ~/.ssh/known_hosts
+        # Rewrite only this repository to SSH, for the cargo process only; the
+        # lockfile keeps the https source.
+        GIT_CONFIG_COUNT=1 \
+          GIT_CONFIG_KEY_0="url.ssh://git@github.com/TinyCloudLabs/policy-engine.insteadOf" \
+          GIT_CONFIG_VALUE_0="$repo" \
+          cargo metadata --locked --format-version 1 --manifest-path test/w5-policy-runtime-node-e2e/Cargo.toml > /dev/null