fix(ci): disable partners a tor-only node serves no network of

A variant that pairs a clearnet-only partner with the onion (Matrix
variant 2 with web-svc-coturn) could draw the tor-only network mode, and
the deploy's domain map then aborted with "web-svc-coturn: allows
['clearnet'] but the node runs in 'tor' mode". disabled_services() now
also emits every deployed partner with domains and a Tor bond whose
networks the node mode does not serve, mirroring utils/cache/domains.py,
so the inventory provision drops it the same way it drops Tor on
clearnet rows. Measured across every role: 8 tor-only rows change, all of
which failed at that point before; clearnet and multi rows are untouched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/unit/python/utils/github/variant/test_axes.py

@@ -5,6 +5,11 @@ import unittest.mock as mock
 
 from utils.github.variant import axes, network, pins, pools
 from utils.roles.display import display_names
+from utils.roles.mapping import (
+    ROLE_FILE_META_DOMAINS,
+    ROLE_FILE_META_NETWORKS,
+    ROLE_FILE_META_SERVICES,
+)
 from utils.symbol_glossary import to_emoji
 
 _REACTIVE = "{{ 'svc-net-tor' in group_names }}"
@@ -38,6 +43,19 @@ _VARIANTS = {
 
 _ALL = ("clearnet", "tor", "multi")
 
+_PARTNER_META = {
+    ("web-svc-relay", ROLE_FILE_META_DOMAINS): {"canonical": ["relay.example"]},
+    ("web-svc-relay", ROLE_FILE_META_SERVICES): {"tor": {"enabled": False}},
+    ("svc-engine", ROLE_FILE_META_SERVICES): {"tor": {"enabled": False}},
+    ("web-svc-dark", ROLE_FILE_META_DOMAINS): {"canonical": ["dark.example"]},
+    ("web-svc-dark", ROLE_FILE_META_SERVICES): {"tor": {"enabled": _REACTIVE}},
+    ("web-svc-dark", ROLE_FILE_META_NETWORKS): {"reachability": {"modes": ["tor"]}},
+}
+
+
+def _partner_meta(app: str, filename: str) -> dict:
+    return _PARTNER_META.get((app, filename), {})
+
 
 def _row(name: str, variant: int, modes: tuple[str, ...], **extra) -> dict:
     return {"name": name, "variant": variant, "modes": modes, **extra}
@@ -264,6 +282,23 @@ class TestNetworkStates(unittest.TestCase):
         self.assertEqual(network.disabled_services("tor"), "")
         self.assertEqual(network.disabled_services("multi"), "")
 
+    @mock.patch.object(network, "_meta", side_effect=_partner_meta)
+    def test_a_partner_the_node_serves_no_network_of_is_disabled(self, _meta) -> None:
+        deployed = ["web-svc-relay", "web-svc-dark", "svc-engine"]
+        self.assertEqual(network.disabled_services("tor", deployed), "web-svc-relay")
+        self.assertEqual(
+            network.disabled_services("clearnet", deployed), "tor web-svc-dark"
+        )
+        self.assertEqual(network.disabled_services("multi", deployed), "")
+
+        (entry,) = _assign(
+            [_row("web-app-a", 0, ("compose",), pin_network="tor", services=deployed)],
+            sweep=0,
+            network_input="auto",
+            variants_per_app=_VARIANTS,
+        )
+        self.assertEqual(entry["disable"], "web-svc-relay")
+
 
 class TestCombinations(unittest.TestCase):
     def test_two_modes_on_the_network_axis_yield_six_runs(self) -> None: