ci: flip every lane to always-trigger with in-workflow gates - #712

A PR touching only .config/nextest.toml (e.g. a future profile edit)
must re-run the tests that consume it; this PR's own run only triggered
because it also edited the core-tests composite.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Four changes, one review story (nextest archive, unified session e2e,
scripts over YAML, composite verify):

- nextest archive replaces the hand-rolled testbins.json + run-testbin.sh:
  build-linux ships testbed/nextest-archive.tar.zst and the test job
  selects harnesses with filtersets under the new profile.vm (one VM at
  a time, hung boots hard-killed at 6 min, no retries - a same-invocation
  retry runs against the leaked vmm/gvproxy of the failed attempt, #588).
- the unified session e2e (scripts/session-e2e.sh) joins the lane,
  covering Deployment Model 3 (native Linux + VM): the minimal CLI is
  built in build-linux (separate invocation - a combined build unifies
  libkrun into the CLI, the #694 regression class), ships in the
  testbed, and drives activate/exec/destroy from PATH, with the #588
  reap (sudo: relay leftovers are root-owned) before it and
  cli-e2e-boot.log uploaded.
- the daemon-lifecycle shell blob becomes scripts/lifecycle-e2e.sh:
  PATH-resolved minvmd (no cargo, macOS-reusable), temp workdir, and an
  EXIT-trap teardown so a failed assert cannot strand a daemon.
- the krun_add_disk3 export assert moves into setup-libkrun-linux,
  mirroring the macOS composite and covering release.yml (which uses the
  composite but had no check); an early actionable failure - minvmd's
  compile-time link is the real backstop.

Also per owner direction: workflow comments drop PR/issue and R-numbers
(history belongs in commits, not YAML), and the DM labels are corrected
against docs/specs/03-spec-networking (DM1 is the macOS model; this
lane is DM3, session-e2e.sh header fixed accordingly).

Refs: #687

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The lifecycle step spawns a fresh daemon just like the CLI session e2e,
so it was equally exposed to leaked __krun-vmm/gvproxy children from a
failed harness run. Move the reap to run immediately after the harness
e2es, ahead of both fresh-daemon steps.

Addresses CodeRabbit review on #702.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Three cross-lane changes that must fork every cache exactly once:

- rust-cache gains shared-key (one per job class that compiles the same
  artifacts: workspace/tests/clippy/native-e2e/mac-unit) and save-if
  restricted to main, via new setup-rust inputs forwarded from
  core-tests. PR branches restore but never write, so PR churn stops
  LRU-evicting the main caches every PR restores from (the 10 GB pool
  is shared repo-wide).
- the two multi-GB raw actions/cache users (KVM build-linux, macOS
  artifacts stage2) split into cache/restore + main-only cache/save
  guarded on cache-hit.
- CARGO_PROFILE_DEV_DEBUG=line-tables-only in CI (setup-rust env step;
  explicit job env on the mac and KVM jobs that bypass the composite):
  usable backtraces, smaller target trees and caches, faster links -
  without a named Cargo profile, which would move output out of
  target/debug and break codesign/testbed/justfile paths.
- --locked on every workflow cargo invocation (build/test/clippy/
  archive), so a stale Cargo.lock fails loudly instead of silently
  re-resolving; previously only core-tests' cargo fetch enforced it.

Refs: #687

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The last two trigger-level path filters (ci.yml's paths-ignore +
ci-macos.yml/ci-shell-installer.yml's paths) become dorny/paths-filter
changes jobs with if: always() aggregators, completing the lane pattern
the native and KVM lanes established. This unblocks the ruleset flip:
a required context a trigger filter skips stays Expected forever and
wedges the PR; a skipped in-workflow job reports skipped, which the
aggregators treat as pass.

- ci.yml: changes job (code = everything minus md/docs/LICENSE, the old
  paths-ignore inverted); all six jobs gated; ci-success skip-tolerant.
- ci-macos.yml: trigger paths move into a changes filter (keeping the
  rust-toolchain.toml entry); artifacts/e2e/unit gated (the e2e keeps
  the RUN_MACOS_CI kill-switch, ANDed); NEW ci-macos-success aggregator
  - the fifth and final required-check context.
- ci-shell-installer.yml: same flip; aggregator now skip-tolerant.
- ci-docs-skip.yml DELETED: the inverse-path hack (and its wedge and
  silent-ungate failure modes) is obsolete - docs-only changes now skip
  jobs inside always-running workflows.
- ci-gvproxy.yml DELETED: pin verification lives at point-of-use
  (fetch-gvproxy.sh SHA-checks in the KVM lane and release);
  vendor/gvproxy/** joins the KVM changes filter so a pin bump re-runs
  the lane that consumes it.
- workflow comments drop remaining PR/issue and R-numbers (owner
  direction: history belongs in commits, not YAML).

The ruleset itself still requires only ci-success; flipping it to the
five aggregator contexts happens after the soak.

Refs: #687

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

# Conflicts:
#	.github/workflows/ci-linux-native.yml

# Conflicts:
#	.github/workflows/ci-macos.yml

# Conflicts:
#	.github/actions/core-tests/action.yml
#	.github/workflows/ci-linux-kvm.yml

# Conflicts:
#	.github/workflows/ci-macos.yml
#	.github/workflows/ci.yml

Same fix as the lane hotfix: dorny cannot diff push events against our
shallow, credential-free checkouts; pushes to main and dispatches run
everything, PRs keep path economy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>