fix: cover trusted CA in release compose gate

yuqei-infra/scripts/linux_release_common.py

@@ -700,6 +700,7 @@ def synthetic_compose_gate_env_bytes() -> bytes:
             "AI_PROVIDER_API_KEY_FILE": "/synthetic/not-a-secret/provider-api-key",
             "BACKEND_SERVER_NAME": "synthetic.invalid",
             "BACKEND_TLS_CERT_DIR": "/synthetic/tls",
+            "BACKEND_TLS_TRUSTED_CA_FILE": "/synthetic/tls/trusted-ca.pem",
             "BACKUP_HOST_DIR": "/synthetic/backups",
             "COMPOSE_PROJECT_NAME": "yuqei-rc04-structural-gate",
             "CONTRACT_API_PUBLIC_POLICY_RELEASE_DIGEST": "sha256:" + "e" * 64,

yuqei-infra/tests/test_linux_release_build_tools.py

@@ -5,6 +5,7 @@ import gzip
 import importlib.util
 import json
 import os
+import re
 import shutil
 import subprocess
 import sys
@@ -571,6 +572,17 @@ def _synthetic_compose_env_values() -> dict[str, str]:
     return values
 
 
+def test_synthetic_compose_gate_env_covers_required_interpolation() -> None:
+    required: set[str] = set()
+    for relative_path in common.COMPOSE_GATE_POLICY["compose_inputs"]:
+        compose_text = (REPO_ROOT / relative_path).read_text(encoding="utf-8")
+        required.update(re.findall(r"\$\{([A-Z][A-Z0-9_]*):\?", compose_text))
+
+    values = _synthetic_compose_env_values()
+    assert required <= values.keys()
+    assert values["BACKEND_TLS_TRUSTED_CA_FILE"] == "/synthetic/tls/trusted-ca.pem"
+
+
 def _compose_model(
     *, mode: str, profile_name: str, profiles: tuple[str, ...]
 ) -> dict[str, Any]: