ci(pr-gate): consolidate runner bundles

[ewen-poch]

Problem

PR validation currently repeats checkout, Node setup, npm ci, Electron builds, and equivalent E2E journeys across PR Gate, PR Check, and the standalone Windows portability workflow. The duplicate workflows also expose overlapping required-check surfaces, while the lane-level implementation in PR Gate can allocate more than twenty runners for a full change.

Proposed change

• Keep PR Gate as the single stable required check and preserve dependency-aware lane selection.
• Execute selected lanes through seven parallel runner bundles: policy, static, unit, macOS coverage, Windows core, macOS E2E, and Windows E2E.
• Share installation and Electron build work inside each OS bundle while retaining per-lane diagnostics, hard/advisory semantics, and failure artifacts.
• Retire the superseded PR Check, standalone commit-message check, and standalone Windows path-portability workflows.
• Preserve merge_group support, immutable Action references, trusted-base classification, and fail-closed final aggregation.

flowchart LR
  A[Preflight and trusted classifier] --> B[Policy]
  A --> C[Static]
  A --> D[Unit]
  A --> E[macOS coverage]
  A --> F[Windows core]
  A --> G[macOS E2E]
  A --> H[Windows E2E]
  B --> I[PR Gate]
  C --> I
  D --> I
  E --> I
  F --> I
  G --> I
  H --> I

Loading

Scope and non-goals

This changes CI execution topology only. It does not change product architecture, source code, data models, data relationships, or user interaction. AI PR Review remains advisory and outside the required gate. Release, nightly, and platform soak workflows remain independent.

Acceptance criteria and validation

All listed checks ran after the last material workflow edit.

Expected behavior	Command	Result
Workflow syntax and expressions are valid	actionlint .github/workflows/pr-gate.yml .github/workflows/ci-integrity.yml	Passed
Bundle selection, trusted aggregation, action pinning, legacy-workflow retirement, and lane coverage are enforced	npm exec vitest run scripts/ci	Passed: 7 files, 103 tests
TypeScript remains valid	npm run typecheck	Passed
Repository lint policy remains satisfied	npm run lint	Passed: 0 errors; 23 existing warnings
Full repository behavior remains intact	npm test	Passed: 649 files and 9,582 tests; 15 files and 184 tests skipped
Patch has no whitespace errors	git diff --check	Passed
Protected gate changes require explicit maintainer authority	node scripts/ci/check-ci-integrity.mjs --base b9f9d99b87d40232695547c94bca09bd91a99fdf --head 96134f2d1b2d6e78dd46557a49f1dafb577a9434	Expected failure: only protected-gate-control-plane

Independent Standards and Spec reviews found no issues.

Review focus

• Confirm hard-gated lanes cannot be hidden by continue-on-error step collection.
• Confirm advisory Linux unit behavior remains visible but non-blocking.
• Confirm the seven bundles preserve lane coverage while sharing setup/build work.
• Confirm the final PR Gate evaluates the base-branch policy and supports merge queues.

CI Integrity is expected to fail on this PR because .github/workflows/pr-gate.yml is an established protected control-plane file. Once the checks and review evidence are satisfactory, merging requires the configured maintainer ruleset bypass.

[ewen-poch]

CI Integrity is expected to report protected-gate-control-plane on this PR because it changes .github/workflows/pr-gate.yml. This is the intended control-plane tripwire, not an implementation regression. After PR Gate and review evidence are satisfactory, a maintainer ruleset bypass is required.

[github-actions]

Codex Review

Verdict: needs changes

[P1] Change to protected PR Gate workflow is rejected by CI Integrity

.github/workflows/pr-gate.yml:201

Impact: The trusted CI Integrity workflow reports a protected-gate-control-plane violation for any content change to this file, so the required check fails and the pull request cannot merge.

Recommendation: Obtain the explicit maintainer ruleset bypass required for protected gate changes, or use the repository’s approved control-plane migration process.

Summary: Static inspection found a repository-enforced CI integrity blocker: this pull request modifies the protected PR Gate control-plane workflow without an in-repository maintainer bypass.

[ewen-poch]

Acknowledged. This PR intentionally changes the protected PR Gate control plane, and the CI Integrity failure confirms that the tripwire is working. No in-repository bypass will be added. A maintainer should use the configured ruleset bypass only after the consolidated PR Gate and the remaining review checks complete successfully.