fix: read Gitea repo-variable data field; fail closed on unknown nightly status

get_repo_variable read the value field, but Gitea returns the payload in
data — every read returned None, so the nightly gate always treated real
status as bootstrap-allow (run 5800 recorded passed while integration
tests failed). Unknown non-empty statuses also allowed deploys; they now
block (fail closed).

Also backfills correct bg/de/pl/ru/zh translations across the catalog and
removes stray nested keys polluting every entry.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

tests/unit/test_api_clients.py

@@ -923,6 +923,12 @@ class TestGiteaClientActions:
         )
 
     def test_get_repo_variable_returns_value(self) -> None:
+        client = GiteaClient("https://git.example.com", "tok", "owner", "repo")
+        client._session.request = MagicMock(return_value=_mock_response({"data": "v0.28.1"}))
+        result = client.get_repo_variable("PRODUCTION_DEPLOY_TAG")
+        assert result == "v0.28.1"
+
+    def test_get_repo_variable_falls_back_to_value(self) -> None:
         client = GiteaClient("https://git.example.com", "tok", "owner", "repo")
         client._session.request = MagicMock(return_value=_mock_response({"value": "v0.28.1"}))
         result = client.get_repo_variable("PRODUCTION_DEPLOY_TAG")

tests/unit/test_nightly_gate.py

@@ -71,6 +71,17 @@ class TestCli:
         assert result.exit_code != 0
         assert "blocked" in result.output.lower()
 
+    @patch("devx.ci.nightly_gate.GiteaClient")
+    @patch("devx.ci.nightly_gate.get_ci_token")
+    def test_check_unknown_status_blocks_deploy(self, mock_token: MagicMock, mock_client_cls: MagicMock) -> None:
+        mock_token.return_value = "fake-token"
+        mock_client = mock_client_cls.return_value
+        mock_client.get_repo_variable.return_value = "garbage-value"
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--repo", "oblachno/infra", "--action", "check"])
+        assert result.exit_code != 0
+        assert "fail closed" in result.output.lower()
+
     @patch("devx.ci.nightly_gate.GiteaClient")
     @patch("devx.ci.nightly_gate.get_ci_token")
     def test_set_passed(self, mock_token: MagicMock, mock_client_cls: MagicMock) -> None: