ci: fix main — stale RunCause call sites and Playwright on ubuntu-26.04 - #9418

Integrate main through #9418 to repair workflow test compilation and runner compatibility.

Co-authored-by: Brain <1a02c72794dcd0f07058a353bc3a81f4028b8c77c92c87fce6d5c8b85970a20b@buzz.block.builderlab.xyz>
Signed-off-by: Wes <[email protected]>

…small

* origin/main:
  perf(acp): reduce observer CPU and lock overhead (#9381)
  ci: fix main — stale RunCause call sites and Playwright on ubuntu-26.04 (#9418)
  fix(mobile): keep shortcut taps and the member picker from wedging (#9388)
  fix(mobile/ios): close notification code blocks only at line-ending fences (#9349)
  fix(media): run thumbnail regeneration tests in CI and cap rebuild pixels (#9198)
  fix(mobile): never show emoji shortcodes in reaction pills (#9411)
  fix(mobile): isolate channel header scroll rebuilds (#9400)

Signed-off-by: Ravneet Arora <[email protected]>

Existing mobile identities entering the Builderlab hosted flow now
require confirmation before the app reserves the account’s identity
slot, binds the identity, or uploads its secret key. Cancelling leaves
saved community keys usable and allows another identity to be selected,
including after restart. Imported keys remain tentative until approval;
paired keys remain safely retained outside the account slot.

The confirmation shows the receiving account’s verified email and public
key, explains that Builderlab can decrypt the backup and signed-in
account users can recover it, and discloses that the app cannot change
the linked identity later. **Cancel setup** stops future work without
claiming to undo earlier binding or an upload whose acknowledgement was
lost. The user can sign out; missing account identification blocks
confirmation. Browser-initiated binding uses **Link and continue**, with
explicit bind-only wording and no upload.

Fresh keys generated in the current hosted attempt use ordinary
onboarding without an extra backup prompt. Interrupted attempts without
a confirmed backup ask again; approval is deliberately not persisted or
carried across retries, cancellation, restart, account changes, or a
replaced flow. Confirmed matching backup receipts skip the backup
prompt. Cloud recovery and organization-managed backup are separate
flows and are not changed here; this PR does not resolve server-side
consent or recovery-authorization policy.

Updated against main through `ce42853982` (#9418). Integration commit
`dfb29fe5e7` includes the landed Hickory security fix and the shared
workflow-test/runner repair. The consent implementation is unchanged
from Carl’s reviewed `e11025ebed`; the CI merge preserves its configured
public consent journeys.

Validation at `e11025ebed`: 96 focused tests across eight files passed
with public hosted domains configured; Flutter analysis passed. In an
isolated source/Git/build copy, removing pre-adoption consent, bypassing
the upload gate, and removing stale-confirmation checks each failed the
consent journeys; restoring the code passed. Carl’s independent source
review found no blockers. Mandatory hooks and hosted mobile CI passed,
including both consent journeys in the configured public lane.

Integration validation at `dfb29fe5e7`: 99 focused tests passed; one
additional fullscreen-onboarding test failed its background
community-admission assertion. An isolated clean-main control at
`ce42853982` reproduces the same failure with the same expected/actual
values. All consent journeys passed. Required commit and push hooks
passed, including mobile analysis and the broader default mobile suite.
Hosted CI is green at `dfb29fe5e7` ([run
43320753801](https://github.com/block/buzz/actions/runs/43320753801)).
Security and the previously failing Rust/workflow gates now pass. The
Mobile Checks log confirms both consent journeys executed successfully;
that run has no pending checks.

Review follow-up `ac9ac9be35`, integrated with main `279a31daac` at
current head `1acfd2dff6`, is test-only: the browser journey now
restores a saved account key without a receipt, cancels without binding,
restarts and requires explicit approval before `/verify`. Both consent
journeys passed again after integration using the updated CI settings.
Disabling only the production bind gate in an isolated source/Git/build
copy now fails the added step; restoring it passes. Mandatory
commit/push hooks passed. Hosted CI is green at `1acfd2dff6` ([run
43343333843](https://github.com/block/buzz/actions/runs/43343333843));
no failing or pending checks remain. The Mobile Checks log confirms both
consent journeys executed successfully, including the extended
browser-binding journey. Carl’s latest review on `dfb29fe5e7` found no
production blockers; its recommended test gap is addressed by this
follow-up.

Native-device and human acceptance have not been recorded here; the
author’s ready-for-review setting is preserved.

Try it: with two saved self-hosted keys, connect to Builderlab, select
A, cancel, restart, then select B. Check the receiving account and key
before approval. Repeat with an imported/paired key and a browser bind
link; cancel must not reserve or bind the new selection. After an
interrupted upload, cancellation must describe that earlier effects may
remain. Confirm that ordinary brand-new onboarding has no extra backup
step.

---------

Signed-off-by: Wes <[email protected]>
Co-authored-by: Brain <1a02c72794dcd0f07058a353bc3a81f4028b8c77c92c87fce6d5c8b85970a20b@buzz.block.builderlab.xyz>