ci: stabilize release dependency install

.gitea/workflows/release-quality-gate.yml

@@ -30,12 +30,20 @@ jobs:
         env:
           NEXT_PUBLIC_SUPABASE_URL: https://ci-placeholder.supabase.co
           NEXT_PUBLIC_SUPABASE_ANON_KEY: ci-placeholder
+          PIP_INDEX_URL: https://mirrors.aliyun.com/pypi/simple/
+          NPM_CONFIG_REGISTRY: https://registry.npmmirror.com
         run: |
           set -euo pipefail
           python3 -m venv .venv
           export PATH="$PWD/.venv/bin:$PATH"
           python -m pip install --upgrade pip
-          python -m pip install -r requirements.txt -r requirements-dev.txt playwright
+          python -m pip install \
+            "mcp==1.28.1" \
+            "pydantic==2.13.4" \
+            "numpy==2.5.1" \
+            "pandas==2.3.3" \
+            "timezonefinder==8.2.5" \
+            -r requirements.txt -r requirements-dev.txt playwright
           python -m playwright install --with-deps chromium
           npm ci --prefix frontend
           python scripts/run_quality_gate.py --profile release

frontend/tests/staging-backend-workflows.test.ts

@@ -885,6 +885,17 @@ test("manual release gate runs where Docker Compose v2 is available", () => {
   assert.match(workflow, /^on:\n\s+workflow_dispatch:/m);
   assert.match(workflow, /runs-on: manman-linux/);
   assert.match(workflow, /docker compose version --short \| grep -Eq '\^v\?2\\\.'/);
+  assert.match(workflow, /PIP_INDEX_URL: https:\/\/mirrors\.aliyun\.com\/pypi\/simple\//);
+  assert.match(workflow, /NPM_CONFIG_REGISTRY: https:\/\/registry\.npmmirror\.com/);
+  for (const dependency of [
+    "mcp==1.28.1",
+    "pydantic==2.13.4",
+    "numpy==2.5.1",
+    "pandas==2.3.3",
+    "timezonefinder==8.2.5",
+  ]) {
+    assert.match(workflow, new RegExp(dependency.replace(".", "\\.")));
+  }
 });
 
 test("production deploy is manual-only and consumes the accepted staging artifact", () => {