ci(linux-kvm): split the monolith into build and test phases - #699

Generalize the native lane's daemon e2e into scripts/session-e2e.sh,
the SAME proof for all three deployment targets — the CLI already
abstracts where the daemon lives, so the script only needs knobs:

  Linux native (DM2)  no knobs (host daemon, repo as project)
  Linux KVM    (DM1)  E2E_VM=1 E2E_MINIMAL_ARGS=--minvmd
  macOS HVF           E2E_VM=1 (macOS is always VM-backed)

Flow everywhere: clean-state `minimal activate` (the cold activate IS
the autospawn) -> ls --raw -> `attach --command` exec asserting
stdout + exit (sessions are Linux environments on every target, so
`uname -s` == Linux even on macOS hosts) -> warm call -> destroy ->
stop. Timing reported, not asserted. VM targets get minvmd teardown
and guest-boot-log diagnostics. E2E_PROJECT_DIR parameterizes the
project: /tmp on VM targets — the guest sees no host project dir
until project sync lands, and /tmp exists in the guest image.
Portability handled: /tmp-rooted state dirs (macOS sun_path 104),
perl ms-clock fallback (BSD date has no %N).

The mac lane's autospawn step is retired: it only proved `minimal ls`
cold/warm against the spawned VM, which the unified e2e's cold
activate subsumes — and the CLI's macOS session path (activate /
attach / destroy over the vsock bridge) gets covered for the first
time. The native lane invokes the same script unchanged in behavior.
The KVM lane's adoption (E2E_MINIMAL_ARGS=--minvmd) follows once the
build/test split (#699) lands, to avoid cross-PR conflicts on that
file.

Refs: #687

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

… apt retries (#698)

* ci(linux-kvm): make the lane gate-ready — changes filter, aggregator, apt retries

Converts the KVM lane to the always-triggered pattern (#687): the
trigger-level path filter moves into a `changes` job
(dorny/paths-filter, SHA-pinned, pull-requests: read), the e2e gates
on its output (workflow_dispatch runs everything), and a new
`if: always()` aggregator — ci-linux-kvm-success — reports success
when the e2e passed OR was path-skipped and red only on
failure/cancellation. The context joins the required checks after
the lane soaks green; until then the lane stays advisory exactly as
before.

Retries apt installs, the one step class with recorded transient
failures in lane history: the sole main-branch KVM failure (run
28897380911) and both of its manual re-runs died in "Install build
dependencies", and the macOS artifacts job failed twice in "Install
protoc". scripts/ci/retry.sh wraps those three call sites (KVM
deps, setup-rust protoc, mac-artifacts protoc); fetches stay
un-retried — zero recorded failures.

Refs: #687

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci(linux-kvm): split the monolith into build and test phases (#699)

* ci: drop the apt retry wrapper

Remove scripts/ci/retry.sh and unwrap its three call sites (KVM build
deps, setup-rust protoc, ci-macos artifacts protoc). One recorded apt
transient in lane history does not justify carrying retry machinery;
if apt flakes recur we can reintroduce it with fresh evidence.

Refs: #687

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>