Handle Redis under arm64 CI emulation

docs/INSTALLATION_AND_DEPLOYMENT_ARCHITECTURE.md

@@ -164,6 +164,10 @@ The CI host registers arm64 execution with an explicitly supplied,
 digest-pinned `tonistiigi/binfmt` image immediately before the smoke. This
 privileged helper is confined to the release runner and is never part of a
 GovOPlaN target deployment or its runtime image set.
+Because QEMU user-mode execution triggers Redis's arm64 host-kernel COW guard,
+the arm64 smoke suppresses only `ARM64-COW-BUG` while persistence, snapshots,
+and append-only files are disabled. Target Redis services never inherit this
+test-only option.
 The smoke also proves a bounded post-migration table contract and aborts as
 soon as a required container exits, rather than allowing a dead process to
 consume the full readiness timeout.

tests/test_runtime_image_smoke.py

@@ -78,6 +78,8 @@ class RuntimeImageSmokeTests(unittest.TestCase):
         self.assertIn('"--network-alias",\n                "load-balancer"', source)
         self.assertIn("'core_system_settings'", source)
         self.assertIn("'core_runtime_nodes'", source)
+        self.assertIn('if platform == "linux/arm64"', source)
+        self.assertIn('"ARM64-COW-BUG"', source)
 
 
 if __name__ == "__main__":

tools/checks/runtime-image-smoke.py

@@ -259,6 +259,11 @@ def run_smoke(
         "--mount",
         f"type=volume,source={names['volume']},target=/var/lib/govoplan",
     ]
+    redis_command = ["redis-server", "--save", "", "--appendonly", "no"]
+    if platform == "linux/arm64":
+        # QEMU user-mode execution triggers Redis's host-kernel COW guard even
+        # though this isolated smoke disables every persistence mechanism.
+        redis_command.extend(("--ignore-warnings", "ARM64-COW-BUG"))
 
     try:
         _run(("docker", "network", "create", names["network"]), timeout=timeout)
@@ -308,11 +313,7 @@ def run_smoke(
                 "--tmpfs",
                 "/data:rw,noexec,nosuid,size=64m",
                 redis_image,
-                "redis-server",
-                "--save",
-                "",
-                "--appendonly",
-                "no",
+                *redis_command,
             ),
             timeout=timeout,
         )