Register existing runtime gitlink for safe checkout

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "omnibioai-tool-runtime"]
+	path = omnibioai-tool-runtime
+	url = https://github.com/OmniBioAI/omnibioai-tool-runtime.git

draft/progress.md

@@ -203,3 +203,10 @@
 - PR #11 latest head `fac440b4d7b2c97a1c9234ff1b7d162e03390a4d` passed remote CI `37229585080`, then merged normally as `affc86625734bc7825439faef94e69b669b52c76`. New workflow is registered active on GitHub (workflow ID `374835660`). Before first dispatch, run listing is empty.
 - Completed the execution source-identity gate: read actual installed Conda metadata independently in OCI and SIF; require exact pinned package name, scientific version, build, artifact filename, subdir and SHA256/MD5. Bind normalized package-artifact identity into existing schema-v1 build inputs. Missing/mismatched metadata blocks; no version, package pin or schema change was made.
 - Added 84 package-pin negative regressions plus durable reconciliation-failure summary coverage. New adapter suite **154 tests**; full repository **8,392 PASS / 13 SKIP / 0 FAIL**. Ruff/actionlint/diff checks PASS. This patch needs fresh remote CI before the first native dispatch. No actual build/publication has occurred.
+
+### First native dispatch: checkout infrastructure failure — 2026-10-04
+
+- PR #12 passed remote CI `37230009071` and merged as `d9af03fbaa36267c856fe4683775bb74b4301fa2`. Dispatched exactly one native-only run at source `cdd2344ccd83e44e5f1a26f8592af687bc6ea291`: https://github.com/OmniBioAI/omnibioai-tool-images/actions/runs/37230154387.
+- Run reached terminal FAILURE before plan generation or any build. Checkout credential removal failed with `fatal: No url found for submodule path 'omnibioai-tool-runtime' in .gitmodules`, Git exit 128. Selection job `111517949752`; native matrix skipped, zero actual native entries/OCI/SIF builds. Reconciliation checkout failed for the same cause. Zero GHCR writes/publications.
+- Deterministically reproduced the exact `git submodule foreach --recursive true` failure locally. Existing gitlink is already pinned to `a4f3da56c2e6e9fd85e54ba009f6f3456de3b5b5`; the frozen workflow independently identifies its repository as OmniBioAI/omnibioai-tool-runtime. Added only the missing `.gitmodules` path/URL registration; gitlink SHA and frozen factory are unchanged. The same command now exits zero, without fetching or executing submodule code.
+- Added static checkout registration regression. Full suite **8,393 PASS / 13 SKIP / 0 FAIL**, Ruff/actionlint/diff checks PASS. This source-metadata repair must pass fresh remote CI before a fresh-source validation run; failed run history is not rewritten or rerun. Evidence retained at `~/omnibioai-native-validation-evidence/run-37230154387.json`.

tests/test_contract_native_validation.py

@@ -1,5 +1,6 @@
 """Synthetic adapter tests: no container or scientific tool is executed."""
 import copy
+import configparser
 import io
 import json
 from pathlib import Path
@@ -351,3 +352,11 @@ def test_reconciliation_failure_summary_is_durable(plan, tmp_path):
     result = json.loads(output.read_text())
     assert result["status"] == "FAIL" and result["observed_records"] == 0
     assert result["release_complete"] is False and result["publication_authorized"] is False
+
+
+def test_checkout_gitlink_has_registered_repository():
+    configuration = configparser.ConfigParser()
+    configuration.read(REPO / ".gitmodules")
+    runtime = configuration['submodule "omnibioai-tool-runtime"']
+    assert runtime["path"] == "omnibioai-tool-runtime"
+    assert runtime["url"] == "https://github.com/OmniBioAI/omnibioai-tool-runtime.git"