AI/ML CI trust: bare L1 jobs + pytest in L2 generated projects

[ulises-jeremias]

Problem

Scaffold-only CI can mask broken generated tests and skip templates that have no
extensions yet (lessons from Create-Node-App/cna-templates#189–#193). AI/ML templates
and extensions must prove runtime trust, not only install/lint.

Solution

Extend the AI/ML CI plan (#76) with explicit trust requirements:

1. Bare L1 jobs for every new AI/ML template type even when zero extensions exist yet
   (e.g. mlops-sklearn-starter alone).
2. L2 must run pytest (or the template's test command) inside the generated project
   after scaffold — not only uv sync / ruff.
3. Env validation: generated projects must not rely on skipping env schema checks;
   use .env.example / fixtures only. No network/API credentials in default CI.
4. Document these bullets in docs/AI_ML_AUTHORING.md and in each AI/ML profile under
   ci/profiles/.

Parent

Part of #71. Implements trust requirements for #76. Pattern import from CNA #189–#193.

Acceptance criteria

• First AI/ML vertical slice (mlops-sklearn-starter and/or fastapi-ai-chat) has a
  bare L1 job and L2 pytest green.
• Add registry mappings and CI profiles for AI/ML catalog #76 body or linked docs mention bare L1 + pytest explicitly.

[ulises-jeremias]

Closing: opened during the reverted #93 implementation. Reopen if still needed after @okason97 lands the AI/ML catalog.

[ulises-jeremias]

Reopening #92 — invalidating the NOT_PLANNED close.

Bare L1 + L2 pytest is the only thing separating 'scaffold compiles' from 'generated project actually runs.' This was the lesson from Create-Node-App/cna-templates#189–#193 and it applies verbatim here:

• mlops-sklearn-starter (Add mlops-sklearn-starter template #84) has real tests (test_pipeline.py, test_predict.py per the files already designed in Define the common MLOps template contract #83's contract) — scaffold-only CI would lint them but never execute them.
• AI extensions like fastapi-ai-chat (Add fastapi-ai-chat extension MVP #77) ship test_chat.py that imports the OpenAI/mock provider; L2 must uv run pytest them inside the generated project, not just uv sync + ruff.
• Without a bare L1 job for the template type alone (no extensions selected), templates that have zero compatible extensions yet slip through untested.

Reabsorbing this into #76 body is not enough: #76 is about registry/CI profiles plumbing; this issue is the trust policy the profiles must enforce. Keep both open and cross-reference — #76's profiles must mention L1 bare + L2 pytest explicitly, this issue owns the trust contract.

Open work:

• Confirm ci/profiles/* for mlops-sklearn-starter (Add mlops-sklearn-starter template #84) and fastapi-ai-chat (Add fastapi-ai-chat extension MVP #77) run uv run pytest in L2, not only uv sync && ruff.
• Add a bare L1 job for each new AI/ML template TYPE before any extension is selected on top.
• Land this as a paragraph in docs/AI_ML_AUTHORING.md (Define AI/ML taxonomy, categories, and template types #72 / docs: add AI/ML authoring taxonomy guide #104 follow-up).