fix(ci): desktop-native-linux honors the classifier it depends on

[rickylabs]

Summary

desktop-native-linux declared needs: classify but never read the verdict, so it built a .deb
and a signed updater on every PR — 20/20 in the last-20-PR audit (~41 min), including one-file
.agents/ changes (#1055, #1063, #1123) where both scaffold tiers correctly skipped. The job now
reads the classifier outputs exactly like its two siblings and short-circuits to a
skipped-by-policy step when the classifier said neither scaffold tier is needed.

Design notes:

• No new routing in YAML. No dedicated desktop signal exists yet — ci: scope every expensive job to a capability vector — paths decide, labels override #1152 adds needs_desktop
  in the classifier. Until then the conservative proxy is run_static || run_runtime: desktop runs
  whenever any scaffold tier runs, and skips only when the tested classifier said no scaffold work.
• Fail-closed preserved: a failed classify forces RUN=true; only an explicit
  run_static=false && run_runtime=false from a successful classify skips.
• Reporting preserved: the job still starts and reports SUCCESS via the exact
  scaffold-static skipped-by-policy pattern, so it stays eligible as a required check.
• lane-visibility now includes the desktop lane so a policy skip is distinguishable from a real
  run.

Scope

• Archetype / area: tooling (CI workflow only; no packages//plugins/ source)
• Closes ci(e2e-cli): desktop-native-linux ignores the classifier it depends on — builds a .deb on every docs PR #1151

Slices

• S1 gate desktop-native-linux on classifier outputs + skipped-by-policy reporting — 5848e90

Validation

• deno test .github/scripts/ci-classify-changes.test.ts — 30 passed, 0 failed (classifier
  untouched; self-check green)
• YAML parse of .github/workflows/e2e-cli.yml — OK
• Docs-only skip demo: verification PR against this branch (classifier says skip → desktop reports
  skipped-by-policy) — evidence to follow in a PR comment

Harness

• Discrete owner-delegated fix per .llm/tmp/BRIEF.md ("ci(e2e-cli): desktop-native-linux ignores the classifier it depends on — builds a .deb on every docs PR #1151 you may just fix, verify and
  push") — no run dir; ci: scope every expensive job to a capability vector — paths decide, labels override #1152 (the capability-vector redesign) carries the harness run.

Drift / Debt

• none

[rickylabs]

[PHASE: IMPL] [VERDICT: —]

Docs-only skip verified live. Demo PR #1154 (docs-only diff against this branch, opted into the gate via e2e-cli-gate) produced run 30825776156:

Job	Outcome	Steps that ran
classify changes	success	full classify (self-check + diff + decide)
scaffold-static	success	Skipped by policy only
scaffold-runtime	success	Skipped by policy only
desktop-native-linux	success	Skipped by policy only

Before this fix, the identical input (docs-only diff, both tiers skipped) built a .deb + signed updater — proven on #1055/#1063/#1123. The job now reports SUCCESS without building, so it remains eligible as a required check. Demo PR closed after capture; its branch is deleted. The PR's own full run 30825732011 is green across all four jobs (workflow edit forces a full run, as designed).

Acceptance evidence

• desktop-native-linux does not run when the classifier says the PR needs no scaffold work — run 30825776156: classify said skip, desktop executed only the "Skipped by policy" step and reported success (https://github.com/rickylabs/netscript/actions/runs/30825776156)
• Verified on a docs-only PR: the job reports skipped-by-policy rather than building — demo PR test(ci): docs-only skip demo for #1151 (do not merge) #1154, run 30825776156: desktop step list is "Set up job; Skipped by policy; Complete job"
• If a distinct desktop signal is wanted, it is emitted by ci-classify-changes.ts and covered — no distinct signal introduced in this PR: the job reads the existing unit-tested outputs (run_static/run_runtime) as a conservative proxy; the dedicated needs_desktop output lands in the classifier with unit tests in ci: scope every expensive job to a capability vector — paths decide, labels override #1152 (PR ci: scope every expensive job to a classifier capability vector (#1152) #1155)
• The skipped-by-policy reporting pattern matches scaffold-static's existing one, so the job — identical env.RUN + SKIP_REASON + printf-notice pattern, fail-closed on classify failure: https://github.com/rickylabs/netscript/pull/1153/files