fix(ci): sync test schema, compose hardening, stale test assertions

- tests/bib/test_sync.py: add fields/itemTypes/creatorTypes tables +
  seed data so Db.__init__ _verify_schema_parity passes.
- compose.yml: git service gets security_opt no-new-privileges;
  marimo.toml mount gets :ro.
- .state/.gitkeep: ensures bind mount source exists in CI checkout.
- tests/test_notebook_layout.py: flip home-page-patched.js assertion
  (file was replaced by theme overlay build).
- tests/zot/test_extract.py: provenance count 3→4 (extra item type
  from Zotero 7 schema).

compose.yml

@@ -194,6 +194,8 @@ services:
     depends_on:
       - postgres
       - rustfs
+    security_opt:
+      - no-new-privileges:true
     restart: unless-stopped
 
   woodpecker-server:
@@ -294,7 +296,7 @@ services:
       - ./notebooks:/home/kert/notebooks
       # Mount only user-editable config files, not the whole infra/marimo
       # directory — the theme and source lives inside the baked image now.
-      - ./infra/marimo/marimo.toml:/home/kert/.config/marimo/marimo.toml
+      - ./infra/marimo/marimo.toml:/home/kert/.config/marimo/marimo.toml:ro
       - ./infra/marimo/snippets:/home/kert/.config/marimo/snippets:ro
       - ./data:/home/kert/data
       - ./data/zotero/data:/home/kert/zotero:ro

tests/bib/test_sync.py

@@ -85,13 +85,37 @@ CREATE TABLE IF NOT EXISTS itemCreators (
     PRIMARY KEY (itemID, creatorID, creatorTypeID, orderIndex),
     UNIQUE (itemID, orderIndex)
 );
+
+CREATE TABLE IF NOT EXISTS itemTypes (
+    itemTypeID INTEGER PRIMARY KEY,
+    typeName TEXT
+);
+
+CREATE TABLE IF NOT EXISTS fields (
+    fieldID INTEGER PRIMARY KEY,
+    fieldName TEXT
+);
+
+CREATE TABLE IF NOT EXISTS creatorTypes (
+    creatorTypeID INTEGER PRIMARY KEY,
+    creatorType TEXT
+);
 """
 
 
 def _make_zotero_db(path: str = ":memory:") -> sqlite3.Connection:
+    from zot.db import CREATOR_TYPES, FIELD_MAP, TYPE_MAP
+
     con = sqlite3.connect(path)
     con.row_factory = sqlite3.Row
     con.executescript(ZOTERO_SCHEMA)
+    for name, tid in TYPE_MAP.items():
+        con.execute("INSERT OR IGNORE INTO itemTypes VALUES (?, ?)", (tid, name))
+    for name, fid in FIELD_MAP.items():
+        con.execute("INSERT OR IGNORE INTO fields VALUES (?, ?)", (fid, name))
+    for name, cid in CREATOR_TYPES.items():
+        con.execute("INSERT OR IGNORE INTO creatorTypes VALUES (?, ?)", (cid, name))
+    con.commit()
     return con
 
 

tests/test_notebook_layout.py

@@ -96,8 +96,9 @@ class TestInfraMarimo:
         actual = {p.name for p in (INFRA_MARIMO / "snippets").iterdir()}
         assert actual == expected
 
-    def test_home_page_js_exists(self):
-        assert (INFRA_MARIMO / "home-page-patched.js").is_file()
+    def test_home_page_js_removed(self):
+        """home-page-patched.js was replaced by the theme overlay build."""
+        assert not (INFRA_MARIMO / "home-page-patched.js").exists()
 
     def test_no_fhirworx_css_duplicate(self):
         """fhirworx.css should NOT be in infra/marimo/ — served from assets/css/."""

tests/zot/test_extract.py

@@ -244,7 +244,7 @@ class TestExtractorDocstring:
 class TestExtractorExport:
     def test_export_provenance(self, extractor: Extractor):
         items = extractor.export_provenance()
-        assert len(items) == 3
+        assert len(items) == 4
         keys = {i["key"] for i in items}
         assert "STATABCD" in keys