chore: consolidate 37 workflows → 23 (behaviour-preserving)

[hyperpolymath]

Summary

Consolidates the GitHub Actions workflow set from 37 → 23 files,
behaviour-preserving: every job is retained, every job's name: is
kept stable, every on: trigger is preserved (unioned, never narrowed),
and every required estate gate stays an independent, identically-named
status check. Nothing is deleted in the sense of "a check stops running" —
jobs are moved into fewer files, not removed.

Do not merge — the parent session controls merges.

OLD → NEW mapping

OLD file(s)	NEW file	Notes
rust.yml + rust-ci.yml	rust.yml	rust-ci's check/test job keys → rustci_check/rustci_test (names "Cargo check + clippy + fmt" / "Cargo test" unchanged); needs: rewired
security.yml + security-audit.yml	security.yml	duplicate job keys from security-audit prefixed audit_* (names "Security Audit Summary" etc. unchanged); needs: + ${{ needs.* }} rewired
scorecard.yml + scorecard-enforcer.yml	scorecard.yml	jobs analysis + scorecard + check-critical all retained
npm-bun-blocker.yml + ts-blocker.yml	language-blockers.yml	ts-blocker check → ts_check
verify-idris.yml + verify-lean.yml + verify-tlaplus.yml	verify-proofs.yml	jobs type-check / lake-build / tlc retained; path filters unioned
e2e.yml + integration.yml + stress-test.yml + bench.yml	tests.yml	all 11 jobs retained
mirror.yml + instant-sync.yml + boj-build.yml	mirror-sync.yml	all 9 jobs retained
docs.yml + quality.yml	docs-quality.yml	all 6 jobs retained
cflite_pr.yml + cflite_batch.yml	clusterfuzzlite.yml	jobs pr-fuzzing + batch-fuzzing
release.yml + container.yml	release.yml	container's build-and-push job retained

Untouched / kept standalone (13): ci.yml, codeql.yml, dogfood-gate.yml,
hypatia-scan.yml, secret-scanner.yml, rsr-antipattern.yml,
guix-nix-policy.yml, security-policy.yml, workflow-linter.yml,
wellknown-enforcement.yml, hypatia-remediation-sweep.yml,
dependabot-automerge.yml, build-gossamer-gui.yml.

Required gates preserved (independent, stable check names)

Each remains its own workflow file with an unchanged name::

• codeql.yml :: CodeQL Security Analysis
• hypatia-scan.yml :: Hypatia Security Scan
• dogfood-gate.yml :: Dogfood Gate
• secret-scanner.yml :: Secret Scanner
• rsr-antipattern.yml :: RSR Anti-Pattern Check
• guix-nix-policy.yml :: Guix/Nix Package Policy
• security-policy.yml :: Security Policy
• workflow-linter.yml :: Workflow Security Linter
• wellknown-enforcement.yml :: Well-Known Standards (RFC 9116 + RSR)

(CodeQL/secret/SBOM SAST jobs that also live inside security.yml are kept
as additional jobs there — the dedicated codeql.yml / secret-scanner.yml
gate workflows are NOT folded in.)

Job-name preservation was verified mechanically: 91 distinct original job
names → 92 current → 0 missing (the +1 is two previously-anonymous check
keys surfacing distinct names after key-prefixing; no behaviour change).

Concurrency additions

concurrency: { group: ${{ github.workflow }}-${{ github.ref }}, cancel-in-progress: true } added to push/PR check workflows:
rust.yml, security.yml, language-blockers.yml, verify-proofs.yml,
tests.yml, docs-quality.yml.

Deliberately omitted (per estate template — no cancel-in-progress on
release/publish/scheduled/security-upload): scorecard.yml,
clusterfuzzlite.yml, release.yml, mirror-sync.yml.

Validation

$ python3 -c "import yaml,glob; [yaml.safe_load(open(f)) for f in glob.glob('.github/workflows/*.y*ml')]; print(len(glob.glob('.github/workflows/*.y*ml')),'workflows, yaml ok')"
23 workflows, yaml ok

All 23 resulting files yaml.safe_load cleanly. No pre-existing PyYAML
quirks needed working around.

Deliberately NOT merged (and why)

• The required estate gate workflows (codeql, hypatia-scan, dogfood-gate,
  secret-scanner, rsr-antipattern, guix-nix-policy, security-policy,
  workflow-linter, wellknown-enforcement) were left as their own files so
  their status-check names stay stable and independently required.
• ci.yml (multi-language umbrella CI), hypatia-remediation-sweep.yml
  (scheduled fleet sweep), dependabot-automerge.yml (PR automation),
  build-gossamer-gui.yml (distinct toolchain build) kept standalone —
  no meaningful overlap with other files.
• No V-lang / ban-enforcement assets were touched.

Behaviour note

For grouped workflows, on: triggers are the union of the sources, so a
consolidated workflow may now trigger on a superset of events (e.g.
verify-proofs.yml runs all three proof jobs when any proof tree changes,
where previously each had its own path-filtered workflow). This only ever
causes a gate to run more often, never less — no check or trigger is lost.
Path/branch filters are unioned, not dropped, so unrelated pushes still do
not trigger.

🤖 Generated with Claude Code