fix: drop a restored agent's tab mark once the agent quits - #14062

Tracing every name a changed file declares, transitively, reached 798
suites for a one-helper edit, because nearly every file names a suite
that names another. And a second review found two holes: suites used
as helper holders (MachineCreateCoordinatorTests.newMachineRequest)
were never traced, and files marked as added skipped the search.

scripts/ci/test_impact.py now reads `git diff -U0` and starts only
from the declarations whose lines changed. Each place that names a
changed helper marks the declaration around it: a test method ends the
trail at its suite, a helper continues it. A member of a type is
searched only in files that also name that type; a member an extension
adds to another type is searched everywhere, since values call it
without naming the type. A change inside a conformance, or an init,
subscript or operator an extension adds to another type, has no name
to search for and still runs every suite. Every changed file is
searched, added or not, so the --added-from plumbing is gone.

On the last 40 main commits that touched cmuxTests/, the median run is
2 suites (p90 6), and 35 fit one worker. manaflow-ai#14056 selects 24 suites and
its one strict step; manaflow-ai#14062 selects 1 suite.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* ci: run only the edited suites when a diff edits cmuxTests/

Since #14017 a cmuxTests/ diff selects `app-host unit tests` by itself,
and that job runs every suite on seven workers. Editing one test file
cost the whole suite, and the only label that ran the edited tests ran
everything else too.

choose_ci_suite.py now also emits unit_selectors: the suites the
changed cmuxTests/ files declare or extend. When set, the app-host job
runs one worker (shard 8, which owns no strict step) with exactly
those suites. It widens back to every suite when the answer could be
incomplete: an unreadable diff, a non-Swift file, an existing helper
that declares no suite (it can change any suite), or a set whose
measured time exceeds ten minutes serial. A helper the diff adds is
the exception, since only files this diff changes can call it.
`unit-ci` and `full-ci` still run every suite.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* ci: widen a changed-suites run for shared helpers and strict suites

Review of the first cut found three ways it could run too little:

- A suite file that also declares a helper other files can see (47 of
  them, e.g. BundledCLITestSupport, used by 54 files) narrowed to its
  own suite. Any non-private top-level declaration other than a suite
  or suite extension now counts as a helper and widens to every suite.
- A moved helper appeared as added under --no-renames and was treated
  as new. The added list now detects renames.
- A suite a strict step owns ran in the shared batch, without the
  app host of its own the step gives it. Selecting one now widens.

Changed-suites runs also upload the test inventory, so they can be
replayed offline like shard 1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* ci: keep changed-suites runs narrow for helpers and strict suites

Widening to all seven workers was the lazy answer to both cases the
review found:

- A changed helper affects only the files that use it. Find them by
  name, follow them transitively, and run their suites. Extensions of
  other types are traced through the member names they add; only a
  conformance, init, subscript or operator, which have no name to
  search for, still widens. Editing BundledCLITestSupport now runs its
  83 dependent suites.
- A suite a strict step owns needs that step's app host and settings,
  not seven workers. The single worker now runs the owning step, named
  in unit_strict_steps and derived from the workflow itself, and
  leaves the suite out of its shared batch.

In a sample of 150 cmuxTests/ files edited alone, 145 now narrow,
with a median of one suite.

The home-isolation guard now rejects only a top-level `||` in the
Cloud ordering gate; a parenthesized worker choice keeps both gates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* ci: trace a test diff through the declarations it changed

Tracing every name a changed file declares, transitively, reached 798
suites for a one-helper edit, because nearly every file names a suite
that names another. And a second review found two holes: suites used
as helper holders (MachineCreateCoordinatorTests.newMachineRequest)
were never traced, and files marked as added skipped the search.

scripts/ci/test_impact.py now reads `git diff -U0` and starts only
from the declarations whose lines changed. Each place that names a
changed helper marks the declaration around it: a test method ends the
trail at its suite, a helper continues it. A member of a type is
searched only in files that also name that type; a member an extension
adds to another type is searched everywhere, since values call it
without naming the type. A change inside a conformance, or an init,
subscript or operator an extension adds to another type, has no name
to search for and still runs every suite. Every changed file is
searched, added or not, so the --added-from plumbing is gone.

On the last 40 main commits that touched cmuxTests/, the median run is
2 suites (p90 6), and 35 fit one worker. #14056 selects 24 suites and
its one strict step; #14062 selects 1 suite.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* ci: close the tracer gaps a third review reproduced

- A helper type's changed member now traces the type, not the member
  name. A mock app code calls (AgentChatResumeIntentRecorder.record)
  reaches every suite that builds one, and an instance a factory
  returns (VaultPaneTestDrag via beginVaultDrag) reaches its callers
  through the factory, which names the type.
- Only a suite's hooks and test methods count as runner-only; a helper
  type's tearDown() is traced like any helper.
- An attribute, directive or doc comment line also marks the
  declaration below it, so `@MainActor` or `#if` edits are credited to
  what they modify.
- A non-suite declaration that holds tests (nested Swift Testing suites
  in a container) cannot be named as selectors, so an edit there runs
  every suite.
- An import or other file-level line changes the whole file.

Both real reproductions from the review now select the missed suites.
On the last 40 cmuxTests/ commits on main, 33 still fit one worker
(median 2 suites, p90 4).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

#14062 left three gaps in TerminalTabIconRegressionTests:
- it deleted the test for #13299's rule that a title which merely looks
  like an agent command gets no mark; restore it against current
  behavior and drop the now-unused TerminalTabAgentIconResolver
  titleStatusKey(from:);
- the quit-to-shell test could pass without a mark ever being applied;
  assert the resumed agent marks the tab before it quits;
- restored tabs that have not resumed yet (awaiting auto-resume, manual
  resume available) now show no mark; pin that.

Also remove the known-failure entry for the deleted
activeAgentKeepsReleaseTerminalIcon(statusKey:).

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

ff6c6dc ci: stop restoring an iOS GhosttyKit cache nothing saves (manaflow-ai#14189)
2827231 ci: seed DerivedData on the 12 vCPU macOS 26 pool (manaflow-ai#14188)
ae46aa9 Let Computer Use toggles save past unrelated cmux.json issues (manaflow-ai#14183)
a785270 test: fail loudly when portal rendering authority denies a fixture's tab id (manaflow-ai#13937)
9a1dea0 test: pin which terminal tabs get an agent mark after manaflow-ai#14062 (manaflow-ai#14177)
91bcb28 test: run the change-area tests in parallel workers (manaflow-ai#14193)
6d203e8 test: await the geometry publish in the equalize-splits shortcut case (manaflow-ai#13916)
48f1adf ci: balance the guard legs the macOS gate waits on (manaflow-ai#14186)
38117cd test: settle the split's reparent-focus suppression before focus feedback (manaflow-ai#14049)
a12a0b8 ci: neutralize Swift sources without a per-character loop (manaflow-ai#14169)
2b6ca4c ci: stop counting queue time on cancelled jobs as runner minutes (manaflow-ai#14187)
2837f22 test: stop gating terminal focus on key status the app host cannot grant (manaflow-ai#13948)
23c0ce2 test: give each detect-step run its own cmux-ci scratch files (manaflow-ai#14185)
a13ea28 ci: skip Mac lanes that bundled scripts and guard-only lints cannot fail (manaflow-ai#14179)
b59f34f ci: restore Swift packages and a compilation cache for iOS uploads (manaflow-ai#14180)
bcca243 profiling: poll child processes every 0.1 s instead of every second (manaflow-ai#14170)
76d6176 refactor: move 45 leaf browser files into CmuxBrowser (manaflow-ai#14092)
bf13034 test: fail the Desktop drop fast instead of restarting the app host (manaflow-ai#14076)
51d486b ci: start guards and web beside Fast static checks (manaflow-ai#14176)

# Conflicts:
#	.github/workflows/ci-guards.yml
#	.github/workflows/ci.yml
#	.github/workflows/ios-appstore-upload.yml
#	.github/workflows/ios-testflight.yml
#	.github/workflows/nightly.yml
#	.github/workflows/seed-derived-data.yml
#	.github/workflows/test-ios.yml

Keeps the Cloud-only tab icon resolver over #14062's local restored-agent
marks, per the product decision that local tabs keep the plain terminal
icon; the #14177 test now expects no mark while a local agent runs.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>