[raymondginger2018-sudo]

Summary

docs/CI.md can reproduce the Python test environment but not the three checks outside it. This PR adds a section with the exact commands for the secret scan, the browser suite, and both Windows lifecycle pytest groups, and puts npm run test:web into desktop/README.md's validation list with its prerequisites.

Changes

• docs/CI.md — new section "Reproduce the secret, browser, and Windows lifecycle checks":
  • Secret scan: the pinned Gitleaks release and checksum live in security-ci.yml; run gitleaks git --redact --no-banner --exit-code 1 from the repository root (built-in rules + the repository's .gitleaksignore; CI passes no custom config); full-history vs --log-opts=-n 200 caveat spelled out.
  • Browser: Ubuntu 24.04 / Node 22 sequence (npm ci, npx playwright install --with-deps chromium, DEEPCODE_TEST_PYTHON=python npm run test:web), what test:web builds first, and which Python starts the service.
  • Windows lifecycle: both pytest groups — the same 13 files python-ci.yml runs (CI adds --junitxml) — with the lease/ACL split explained.
• desktop/README.md — validation block gains npm run test:web between test and check:protocol, plus a two-line note linking to docs/CI.md for the Python-side prerequisite and Chromium install.

Tests

• Every path and command verified against upstream main @ f183965f: 13/13 lifecycle test files exist; test:web is build:web && playwright test; the DEEPCODE_TEST_PYTHON fallback is confirmed in desktop/e2e/web.spec.ts; the gitleaks invocation is copied from security-ci.yml.
• Documentation only — no code changed.
• Local preflight: KNOWN-RED | jobs=10 | rc0=28 | new=0 | known=2 | skipped=apt,upload | notrun=web-browser | warn=none | tree=0->0 | sanitize=clean | tree_head=770abce6 | audit=SKIPPED | parallel=off | elapsed=2221s (known reds: job-windows-lifecycle:group2_rc=1, job-desktop-quality:test_rc=1, both hit known-reds.txt; new reds: 0).

Dependency note

• Independent of the docs/workflow drift test (tests/test_ci_documentation.py): zero file overlap, merge in any order.

AI-Assisted Disclosure

1. I have read every line and can justify each command against the upstream workflow files.
2. Locally verified per the checks above plus the local preflight gate.
3. Single topic: local reproduction documentation only.
4. AI tool: DeepSeek Harness Agent assisted drafting; final review by me.

[Zongwei9888]

Thank you, @raymondginger2018-sudo! Merged in 7d11c2d. I checked each command against the workflows: the Gitleaks call, the Node 22 and DEEPCODE_TEST_PYTHON browser steps, and both Windows test groups match security-ci.yml, web-ci.yml and python-ci.yml.

One follow-up in 8332d74: the Windows commands used \ line continuations inside a sh block, which PowerShell and cmd don't read as continuations, so I put each group on one line in a powershell block.