ci: fix joint2 cross-unit path (workspace name independent) + trust provisions knowledge venv

- trust test_joint2 walked up to a dir named 'research' — breaks on CI
  runners where the checkout is 'substrate'; walk up until
  apps/knowledge/py exists instead
- python matrix: trust job provisions the knowledge venv (joint2 spawns
  the knowledge gate via uv run)

Author: caiotheodoro

.github/workflows/ci.yml

@@ -43,9 +43,14 @@ jobs:
         # knowledge is a uv workspace ROOT with member packages, so its
         # pytest lives in a member's dev group: --all-packages is required.
         # trust/simulation are plain packages where --all-groups suffices.
+        # trust's joint2 e2e spawns the knowledge gate, so it provisions
+        # knowledge's venv too.
         run: >
           if [ "${{ matrix.unit }}" = "knowledge" ]; then
             uv sync --all-packages --all-groups
+          elif [ "${{ matrix.unit }}" = "trust" ]; then
+            uv sync --all-groups
+            uv --directory ../knowledge/py sync --all-packages --all-groups
           else
             uv sync --all-groups
           fi

apps/trust/py/tests/test_joint2.py

@@ -19,9 +19,13 @@
 from trust.extractors.retrieval_ladder import RetrievalLadder, LadderRung
 
 PORT = 18084
-REPO_ROOT = Path(__file__).resolve()
-while REPO_ROOT.name != "research" and REPO_ROOT != REPO_ROOT.parent:
-    REPO_ROOT = REPO_ROOT.parent
+# Walk up from this file until we find the monorepo root (contains
+# apps/knowledge/py). Works locally (dir "research") and in CI (dir
+# "substrate") without hardcoding the workspace name.
+_REPO = Path(__file__).resolve()
+while not (_REPO / "apps" / "knowledge" / "py").exists() and _REPO != _REPO.parent:
+    _REPO = _REPO.parent
+REPO_ROOT = _REPO
 KNOWLEDGE_PY = REPO_ROOT / "apps/knowledge/py"
 
 GATE_SERVER = f"""