feat(gitea-phoenix): gov runtime, deploy/template parity, workflow dedupe docs

- Add gov-portals-runtime.v1.json + schema; jq gate in validate-config-files
- Python: parity-deploy-targets, parity-operational-template (IP strict, hostname WARN),
  parity-gov-portals-runtime; validate-vm-routing-parity.sh wrapper
- check-gov-portal-workflow-canonical-strings.sh for monorepo Pattern A
- PORTAL_WORKFLOW_PARITY.md; template headers; repos README; operator checklist secrets
- report-gitea-cd-parity runs full VM routing parity; task doc marked complete
- GOV_PORTALS_XOM_DEV + GITEA_GOV + MASTER_INDEX + matrix doc cross-links

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/validation/validate-config-files.sh

@@ -307,14 +307,41 @@ else
   # Non-blockchain VM routing matrix (closure vs reports/status/live_inventory.json)
   if [[ -x "$PROJECT_ROOT/scripts/verify/validate-non-blockchain-vm-routing-matrix.sh" ]]; then
     if "$PROJECT_ROOT/scripts/verify/validate-non-blockchain-vm-routing-matrix.sh" "$PROJECT_ROOT"; then
-      log_ok "non-blockchain-vm-routing-matrix: inventory closure vs matrix"
+      log_ok "non-blockchain-vm-routing: inventory + deploy-target + operational + gov-runtime parity"
     else
-      log_err "non-blockchain-vm-routing-matrix: validation failed (regenerate: python3 scripts/lib/non_blockchain_vm_routing_matrix.py generate …)"
+      log_err "non-blockchain-vm-routing: validation failed (regenerate: python3 scripts/lib/non_blockchain_vm_routing_matrix.py generate …)"
       ERRORS=$((ERRORS + 1))
     fi
   else
     log_warn "validate-non-blockchain-vm-routing-matrix.sh missing or not executable; skipping"
   fi
+  if [[ -f "$PROJECT_ROOT/config/gitea-phoenix/gov-portals-runtime.v1.json" ]] && command -v jq &>/dev/null; then
+    if jq -e '
+      (.schemaVersion == "1")
+      and (.lxc_vmid == 7804)
+      and (.lan_ipv4 | type == "string")
+      and (.portals | type == "array")
+      and (.portals | length == 4)
+      and ((.portals | map(.id) | sort) == ["DBIS","ICCC","OMNL","XOM"])
+    ' "$PROJECT_ROOT/config/gitea-phoenix/gov-portals-runtime.v1.json" &>/dev/null; then
+      log_ok "gov-portals-runtime.v1.json: schemaVersion, vmid, four portals"
+    else
+      log_err "gov-portals-runtime.v1.json: invalid structure or portal set"
+      ERRORS=$((ERRORS + 1))
+    fi
+  else
+    log_warn "gov-portals-runtime.v1.json missing or jq not installed; skipping"
+  fi
+  if [[ -x "$PROJECT_ROOT/scripts/verify/check-gov-portal-workflow-canonical-strings.sh" ]]; then
+    if "$PROJECT_ROOT/scripts/verify/check-gov-portal-workflow-canonical-strings.sh"; then
+      log_ok "gov-portal monorepo workflow strings (optional path)"
+    else
+      log_err "gov-portal monorepo workflow canonical string check failed"
+      ERRORS=$((ERRORS + 1))
+    fi
+  else
+    log_warn "check-gov-portal-workflow-canonical-strings.sh missing or not executable; skipping"
+  fi
   # Proxmox operational template (VMID/IP/FQDN mirror; see docs/03-deployment/PROXMOX_VE_OPERATIONAL_DEPLOYMENT_TEMPLATE.md)
   if [[ -f "$PROJECT_ROOT/config/proxmox-operational-template.json" ]]; then
     log_ok "Found: config/proxmox-operational-template.json"