CI: finish the truthful-master work — remove `|| true` in ci-memory-env.sh, split setup from verdict steps, cache the dev image, delete the "GitHub Actions is disabled" claims, enable branch protection (re-#36209)

[PurHur]

Category

Foundation: · CI truthfulness · child of #36188 · respin of #36209 (closed by PR #36233, which re-diffed the structgep patch, added --verify-pristine for two patches, and removed one || true in ci-common.sh)

Problem — what is still open from #36209

• script/ci-memory-env.sh:36 still runs apply-patches.sh >/dev/null 2>&1 || true — a local patch failure stays invisible (this is how the fictional-context patch shipped).
• --verify-pristine covers only the structgep and icmp patches (patches/pristine-snapshots/ has one file); the other 181 patches keep grep-marker idempotency (see Foundation: patches/ are no longer the source of truth — apply-patches.sh is 7,508 lines with 85 overlay functions and 412 grep guards, 92 of 183 patches neither apply nor reverse cleanly; fork php-cfg/php-types and keep patches only for php-llvm (patches/, script/apply-patches.sh) #36229 for the mechanism and for the php-cfg-simplifier-use-chain.patch case, whose marker skipped the July 25 default flip on every already-patched tree).
• Workflows still run setup and verdict in one step, so a 2-minute "failure" cannot be told from a regression in gh run view --log-failed; the dev image is still rebuilt on every run (60–90 s).
• .cursor/rules/local-ci-only.mdc (alwaysApply: true), README.md §CI and CONTRIBUTING.md still say GitHub Actions is disabled.
• gh api repos/PurHur/php-compiler/branches/master/protection → 404: red cannot block a merge.

PHP implementation target

Steps 3–5 of #36209 verbatim: remove the || true; named Setup / Verdict steps with a setup-failed summary marker; GHCR-cached php-compiler:22.04-dev rebuilt only on Dockerfile diff; docs rewritten to describe the four workflows; branch protection requiring Compiler gate once it is green for 24 h.

Done when

• Deleting a vendor patch makes ci-fast.sh exit non-zero within 30 s
• gh run view --log-failed names Setup vs AOT smoke; median gate run ≥ 60 s faster
• grep -ri "actions.*disabled" .cursor README.md CONTRIBUTING.md = 0; branches/master/protection requires Compiler gate

[PurHur]

Cleanup bot: duplicate re-spin — parent issue already closed; work tracked on the original. See #36142 / #36188 priority list.

[PurHur]

Cleanup bot: reopened — these are intentional follow-ups / part-B items tracked on #36188, not status slop.

[PurHur]

claim: implementer-worker-lane-b — starting this run (lane B tie-break #36247 % 3 == 1)

[PurHur]

claim: implementer-worker-lane-b — continuing this run (lane B tie-break; ci-memory-env || true already fixed on master, finishing remaining items)

[PurHur]

claim: implementer-worker-lane-b — finishing remaining items (selfhost-preflight || true, ci-fast patch-failure gate test)