fix(e2e): align authorized workflow contracts

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

Author: cv

.github/workflows/e2e.yaml

@@ -4622,7 +4622,7 @@ jobs:
 
       - name: Run all-agent GPU, local inference, rollback, and cleanup qualification
         env:
-          NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
+          NVIDIA_API_KEY: ${{ github.repository == 'NVIDIA/NemoClaw' && github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && (inputs.checkout_sha == '' || needs.generate-matrix.outputs.e2e_credentials_allowed == 'true') && secrets.NVIDIA_API_KEY || '' }}
         shell: bash
         run: |
           set -euo pipefail

test/e2e/support/e2e-report-to-pr-workflow-boundary.test.ts

@@ -97,7 +97,7 @@ function executeGenerateMatrixWithPlannerOutput(
     fakeNpx,
     [
       "#!/usr/bin/env bash",
-      "expected=(tsx tools/e2e/workflow-plan.mts --ci-output)",
+      "expected=(--no-install tsx tools/e2e/workflow-plan.mts --ci-output)",
       'actual=("$@")',
       '[[ "${#actual[@]}" -eq "${#expected[@]}" ]] || exit 97',
       'for index in "${!expected[@]}"; do [[ "${actual[$index]}" == "${expected[$index]}" ]] || exit 97; done',

test/e2e/support/native-runtime-qualification-producer-workflow.test.ts

@@ -43,7 +43,7 @@ function expectRequiredPodmanPackages(run: string): void {
 describe("native runtime qualification producer workflow", () => {
   it("keeps candidate execution out of the authenticated controller", () => {
     const generate = job("generate-matrix");
-    const checkout = generate.steps?.find((entry) => entry.uses?.startsWith("actions/checkout@"));
+    const checkout = step(generate, "Check out E2E candidate");
 
     expect(checkout?.if).toContain("inputs.jobs != 'native-runtime-qualification-producer'");
     expect(step(generate, "Validate manual PR checkout").if).toContain(

tools/e2e/mcp-dev-workflow-boundary-digests.mts

@@ -10,7 +10,7 @@ export const MCP_DEV_JOB_EXECUTION_CONTEXT_SHA256 =
 export const MCP_DEV_TRUSTED_NODE_SETUP_CONTENT_SHA256 =
   "504821ad93c57971d0281ef1130ed6008fadd331bd56acb1a6b5e6a3358f3e49";
 export const MCP_DEV_TRUSTED_PREFIX_CONTENT_SHA256 =
-  "067df18297c3b5e5175dc11de071a0f3c261aa894db6141b8b789d67f5e9c0d1";
+  "c559e6cd5bf076bed8d359bbca397d4e31fbf3c11123389425917b865544940d";
 export const MCP_DEV_POST_INSTALL_TRANSITION_CONTENT_SHA256 =
   "62cf2ee01ac7192f41fc7b2b071de729da8bacec1e4f693da1ec6f0b1f4723c0";