ci(pr-gate): prepare trusted runner bundle execution

[ewen-poch]

Problem

The shadow PR Gate preserves semantic coverage, but its 21 execution lanes create avoidable runner queue pressure. The workflow cannot safely switch to bundled jobs in the same pull request that introduces bundle planning because preflight and aggregation intentionally execute the classifier and evaluator from the exact base SHA.

Proposed change

Prepare the trusted control plane for a later topology change:

• map every semantic lane deterministically to one of seven execution bundles: policy, static, unit, coverage_macos, windows_core, macos_e2e, and windows_e2e;
• publish the selected bundles as an additive field in the change-impact plan while preserving semantic lanes;
• add an opt-in bundle aggregation mode while keeping lane aggregation as the default;
• fail closed when the execution mode or bundle plan is missing, malformed, unknown, duplicated, incomplete, extra, or inconsistent with the semantic lanes.

flowchart LR
  A["Phase A PR"] --> B["Trusted base classifier and evaluator"]
  B --> C["Existing 21 semantic jobs"]
  C --> D["Lane-mode PR Gate"]
  D --> E["Phase A squash merge"]
  E --> F["Bundle planning becomes trusted on main"]
  F --> G["Phase B workflow PR"]
  G --> H["About 7 validation bundles plus preflight and gate"]

Loading

Scope and non-goals

• The existing 23-job PR Gate workflow is deliberately unchanged in this phase.
• No product architecture, data model, data relationship, or user interaction changes are included.
• Phase B will change only the workflow execution topology after these controls are trusted from main.
• AI PR Review remains outside the deterministic PR Gate.

Acceptance criteria and validation

All listed checks ran after the final material edit:

• deterministic lane-to-bundle selection and fail-closed validation -> npm test -- --run scripts/ci -> 7 files, 99 tests passed;
• Node and web type safety -> npm run typecheck -> passed;
• repository lint -> npm run lint -> 0 errors (23 pre-existing warnings outside this diff);
• changed-file formatting -> npx prettier --check <changed files> -> passed;
• full coverage regression suite -> npm run test:coverage -> 650 files and 9,560 tests passed; 15 files and 184 tests skipped; 87.71% statement coverage;
• independent Standards review -> no findings;
• independent Spec review -> no findings.

CI Integrity is expected to report protected-gate-control-plane for the manifest, classifier, and evaluator. This PR therefore requires an explicit maintainer ruleset bypass. The hosted PR Gate should continue to pass through the trusted base-SHA lane path.

Review focus

• Confirm that the mapping preserves every semantic lane while reducing the future execution surface to seven bundles.
• Confirm that lane mode remains fully backward compatible until Phase B explicitly sets bundle mode.
• Confirm that malformed or inconsistent bundle plans cannot pass aggregation.

Uncovered risk: this phase does not measure the runner-queue improvement because it intentionally does not change workflow jobs. That measurement belongs to Phase B after this compatibility layer is merged.

[ewen-poch]

Maintainer note on the staged trust migration:

• The CI Integrity failure for scripts/ci/change-impact.json, classify-pr-changes.mjs, and evaluate-pr-gate.mjs is expected. These are protected control-plane files, so merging this PR requires an explicit maintainer ruleset bypass.
• The bypass applies only to that integrity policy. The base-SHA PR Gate must still complete successfully in its existing lane mode.
• The workflow topology is intentionally unchanged here: this PR first makes bundle planning and bundle-aware aggregation trusted on main; the follow-up PR will then switch the workflow to bundled jobs using these controls from its base SHA.

[github-actions]

Codex Review

Verdict: mergeable

No actionable findings.

Summary: Static inspection found no concrete merge-blocking defects in the requested changes.

[ewen-poch]

The first hosted Coverage macOS run exposed a CI-only test isolation issue, which is fixed in 6b24707:

• Root cause: the bundle-mode CLI test inherited Actions' GITHUB_STEP_SUMMARY, so the child evaluator correctly wrote its result to the summary file while the test incorrectly asserted stdout.
• Fix: clear GITHUB_STEP_SUMMARY only for that subprocess test, because this case explicitly verifies the stdout CLI interface. Production evaluator behavior is unchanged.
• Verification after the fix: the failure reproduces with a non-empty inherited summary path before the change and passes after it; npm test -- --run scripts/ci passes 99 tests; npm run test:coverage passes 9,560 tests across 650 files with 87.71% statement coverage; typecheck, lint, and changed-file formatting pass.

[github-actions]

Codex Review

Verdict: mergeable

No actionable findings.

Summary: Static inspection found no concrete merge-blocking defects. Bundle mode remains opt-in; the existing lane-based workflow is preserved.