ci: seed isolated Lesavka runtime qualification from exact artifacts

services/jenkins/configmap-jcasc.yaml

@@ -240,6 +240,7 @@ data:
             // Seed reloads replace Pipeline-added properties; retain the same bounds here.
             properties {
               disableConcurrentBuilds()
+              copyArtifactPermission { projectNames('lesavka-runtime-tests') }
               buildDiscarder {
                 strategy {
                   logRotator {
@@ -411,6 +412,44 @@ data:
               }
             }
           }
+          pipelineJob('lesavka-runtime-tests') {
+            properties {
+              disableConcurrentBuilds()
+              buildDiscarder {
+                strategy {
+                  logRotator {
+                    daysToKeepStr('14')
+                    numToKeepStr('8')
+                    artifactDaysToKeepStr('-1')
+                    artifactNumToKeepStr('4')
+                  }
+                }
+              }
+            }
+            description('Exact archived server in an isolated real-systemd VM. No host devices, Android installation, signing or deployment.')
+            parameters {
+              stringParam('EXPECTED_SOURCE_REVISION', '', 'Exact reviewed fixture source commit.')
+              stringParam('COMPONENT_SOURCE_REVISION', '', 'Exact archived AMD64 native source commit.')
+              stringParam('COMPILER_BUILD_NUMBER', '', 'Specific lesavka-compile run; never latest.')
+              stringParam('COMPONENT_ARCHIVE_SHA256', '', 'Reviewed compiler archive SHA-256.')
+              stringParam('SERVER_SHA256', '', 'Reviewed server executable SHA-256.')
+              stringParam('VM_WORKER_IMAGE', '', 'Reviewed lesavka-runtime-vm image by digest.')
+            }
+            definition {
+              cpsScm {
+                scm {
+                  git {
+                    remote {
+                      url('https://scm.bstein.dev/bstein/lesavka.git')
+                      credentials('gitea-pat')
+                    }
+                    branches('*/dev-phone-companion-updates')
+                  }
+                }
+                scriptPath('docker/Jenkinsfile.runtime')
+              }
+            }
+          }
           pipelineJob('lesavka') {
             // Re-enable after the pinned worker and current source are qualified.
             disabled(true)

services/jenkins/configmap-plugins.yaml

@@ -28,3 +28,6 @@ data:
     # bump above is required by the workflow-cps these pull in.
     junit:1369.v15da_00283f06
     pipeline-stage-view:2.41
+    # Latest compatible release for core 2.528.3; Production permission mode.
+    # SHA-256: 10f61e08f7cdcdff77473f53e376dab356b17e89fbb3c3860fa18e8981ef8f8a
+    copyartifact:795.ve8e151429b_27