🔧 收紧本地脚本与 runner 产物边界

tests/template_defaults_test.sh

@@ -55,6 +55,21 @@ test_workflow_docs_and_links_use_actual_paths() {
     ! rg -q '/\\.github/workflows/' "${release_workflow}" || fail "release workflow should not link to .github/workflows"
 }
 
+test_presets_do_not_mount_check_crlf_helper() {
+    ! rg -q 'check_crlf\.sh:/data/check_crlf\.sh:ro' "${REPO_ROOT}/docker-runner/presets" || fail "preset compose files should not mount check_crlf helper into containers"
+}
+
+test_runner_data_is_gitignored() {
+    local path
+
+    for path in \
+        "docker-runner/presets/standard-ubuntu-22/runner-data/config.yaml" \
+        "docker-runner/presets/buildx-ubuntu-22/runner-data/config.yaml" \
+        "docker-runner/presets/buildx-archlinux/runner-data/config.yaml"; do
+        git -C "${REPO_ROOT}" check-ignore -q "${path}" || fail "${path} should be ignored as runtime runner data"
+    done
+}
+
 test_preset_env_examples_exist() {
     local file
 
@@ -72,6 +87,8 @@ test_preset_compose_uses_env_for_instance
 test_workflows_do_not_hardcode_company_server
 test_stats_workflow_uses_workflow_secret_consistently
 test_workflow_docs_and_links_use_actual_paths
+test_presets_do_not_mount_check_crlf_helper
+test_runner_data_is_gitignored
 test_preset_env_examples_exist
 
 echo "template_defaults_test.sh: PASS"