[pitboss] phase 03: M3 — Docker backend + sandbox-escape regression suite

.github/workflows/ci.yml

@@ -197,8 +197,8 @@ jobs:
       - name: Compile check at MSRV
         run: cargo check --all-features --tests
 
-  rust-stable-test:
-    name: rust-stable-test
+  rust-stable-test-linux-without-docker:
+    name: rust-stable-test / linux-without-docker
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -210,9 +210,35 @@ jobs:
 
       - uses: taiki-e/install-action@nextest
 
-      - name: Rust tests (stable)
+      - name: Rust tests (stable, no docker)
         run: cargo nextest run --all-features
 
+  rust-stable-test-linux-with-docker:
+    name: rust-stable-test / linux-with-docker
+    runs-on: ubuntu-latest
+    services:
+      docker:
+        image: docker:dind
+        options: --privileged
+    env:
+      DOCKER_TLS_CERTDIR: ""
+      DOCKER_HOST: tcp://docker:2375
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: stable
+          cache: true
+
+      - uses: taiki-e/install-action@nextest
+
+      - name: Pull python image for sandbox tests
+        run: docker pull python:3-slim
+
+      - name: Rust tests with docker (sandbox escape gate)
+        run: cargo nextest run --all-features --test dynamic_sandbox_escape --test dynamic_parity
+
   cross-platform-smoke:
     name: cross-platform-smoke
     strategy: