fix(standards): correct service-docker quality gate to use the private index

Authenticate the quality-gate pip install with the private index URL (scheme-stripped AUTH_URL, --index-url/--extra-index-url) instead of the broken --extra-index-url form, and guard against missing PIP_* secrets. Also drop the fetch-tags inline comments. Regenerated the mcp copy from src.

standards/mcp/templates/drone/service-docker.yaml

@@ -25,18 +25,14 @@ steps:
       - apk add --no-cache git
       - git fetch --tags
       - |
-        # Get latest Git tag and trim newline
         LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null | tr -d '\n')
         echo "Latest Git tag fetched: $LATEST_TAG"
 
-        # Save to file for downstream steps
         echo "$LATEST_TAG" > /drone/src/LATEST_TAG.txt
 
-        # Read back for verification
         IMAGE_TAG=$(cat /drone/src/LATEST_TAG.txt | tr -d '\n')
         echo "Image tag read from file: $IMAGE_TAG"
 
-        # Validate
         if [ -z "$IMAGE_TAG" ]; then
           echo "No git tags found! Cannot continue."
           exit 1
@@ -87,7 +83,13 @@ steps:
         from_secret: PIP_PASSWORD
     commands:
       - pip install --upgrade pip
-      - pip install --extra-index-url "https://$PIP_USERNAME:$PIP_PASSWORD@$PIP_REPO_URL/simple" -r requirements.txt
+      - |
+        if [ -z "$PIP_REPO_URL" ] || [ -z "$PIP_USERNAME" ] || [ -z "$PIP_PASSWORD" ]; then
+          echo "PIP_REPO_URL / PIP_USERNAME / PIP_PASSWORD are not set" >&2
+          exit 1
+        fi
+      - AUTH_URL="https://$PIP_USERNAME:$PIP_PASSWORD@$(echo "$PIP_REPO_URL" | sed -E 's|^[a-zA-Z]+://||; s|/*$||')/simple"
+      - pip install --index-url "$AUTH_URL" --extra-index-url https://pypi.org/simple/ -r requirements.txt
       - pip install black ruff mypy
       - echo "Running quality gate..."
       - python -m black --check .

standards/src/templates/drone/service-docker.yaml

@@ -25,18 +25,14 @@ steps:
       - apk add --no-cache git
       - git fetch --tags
       - |
-        # Get latest Git tag and trim newline
         LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null | tr -d '\n')
         echo "Latest Git tag fetched: $LATEST_TAG"
 
-        # Save to file for downstream steps
         echo "$LATEST_TAG" > /drone/src/LATEST_TAG.txt
 
-        # Read back for verification
         IMAGE_TAG=$(cat /drone/src/LATEST_TAG.txt | tr -d '\n')
         echo "Image tag read from file: $IMAGE_TAG"
 
-        # Validate
         if [ -z "$IMAGE_TAG" ]; then
           echo "No git tags found! Cannot continue."
           exit 1
@@ -87,7 +83,13 @@ steps:
         from_secret: PIP_PASSWORD
     commands:
       - pip install --upgrade pip
-      - pip install --extra-index-url "https://$PIP_USERNAME:$PIP_PASSWORD@$PIP_REPO_URL/simple" -r requirements.txt
+      - |
+        if [ -z "$PIP_REPO_URL" ] || [ -z "$PIP_USERNAME" ] || [ -z "$PIP_PASSWORD" ]; then
+          echo "PIP_REPO_URL / PIP_USERNAME / PIP_PASSWORD are not set" >&2
+          exit 1
+        fi
+      - AUTH_URL="https://$PIP_USERNAME:$PIP_PASSWORD@$(echo "$PIP_REPO_URL" | sed -E 's|^[a-zA-Z]+://||; s|/*$||')/simple"
+      - pip install --index-url "$AUTH_URL" --extra-index-url https://pypi.org/simple/ -r requirements.txt
       - pip install black ruff mypy
       - echo "Running quality gate..."
       - python -m black --check .