ci: run the engine's CI on the GCP fleet (pf-gcp-pr / pf-gcp-main) - #472

…64 slice

That slice now runs on the self-hosted pf-gcp-main fleet, which has no sudo and
bakes libeigen3-dev 3.4.0 into its image. The hosted Linux slice (linux-aarch64)
still installs it, so the step is kept and narrowed to it.

Co-Authored-By: Claude Code <[email protected]>

Companion to the narrowed apt step: on the self-hosted linux-x86_64 slice the job now asserts the Eigen 3.4 headers exist before configuring, so a missing system Eigen stops the release instead of falling back to an unverified source.

Co-Authored-By: Claude Code <[email protected]>

The previous commit moved 16 engine runs-on sites to ["self-hosted","pf-gcp-pr"]
and ["self-hosted","pf-gcp-main"]. .github/actionlint.yaml only declares the
retired pool labels, so actionlint (and the engine's own
test_actionlint_runner_labels_rejects_removed_label, which removes one of these
two labels from the config and requires the checker to refuse) would fail on
the new workflows.

This declares both labels and keeps every existing label declared; nothing is
removed. It is outside the pins lane's three-file scope and was edited by the
supervisor as a two-line glue change.

Co-Authored-By: Claude Code <[email protected]>

Preflight pins, their tests and docs/ci.md follow the runs-on move to
["self-hosted","pf-gcp-pr"] (authz and every non-release job, every ref)
and ["self-hosted","pf-gcp-main"] (release, the linux-x86_64 prebuilt,
notify-hub and baseline promotion), owner order via laneboss #1056/#1057.
The LIGHT/LINUX pool split and the corpus conditional pin are retired.
Refusal tests are kept and widened: a release-class job on -pr, a
non-release job on -main, any retired pool label or the void
pf-gcp-engine-* labels, a hosted fallback expression, a dropped routed job
and the legacy corpus conditional all fail the check.

Lane core-org-engflip-pins (ORG-CX); diff read by CORE-TOP. Tests not run on
the Mac; the PR's CI on pf-gcp-pr is the proof.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

… the fleet

corpus-parity.yml triggers on pull_request (corpus and parity-tooling paths)
and had no authz job. Its old conditional runs-on was the only fork and
pull_request_target guard; moving both jobs to a literal
["self-hosted","pf-gcp-pr"] left a fork pull request running untrusted code on
a fleet that has sudo and docker. docs.yml accepted pull_request too, with an
ungated job still on GitHub-hosted ubuntu-latest.

Both workflows now start with the canonical authz job, byte-identical to
ci.yml's (the same header comment, the space inside the array, the same single
step whose sha256 scripts/ci_preflight.py pins), and every other job needs it:
corpus-parity and corpus-parity-subset, and docs build. Docs build moves from
ubuntu-latest to ["self-hosted","pf-gcp-pr"]; its Cloudflare deployment step
still skips pull_request. Outsider pull requests run no CI and get no hosted
fallback; dependabot counts as ours through the authz allowlist (CI-DEPBOT A).

scripts/ci_preflight.py gains gated_workflow_findings(): first job authz,
verbatim canon header and step hash, no authz overrides (needs/if/env/uses/
strategy/continue-on-error), needs authz on every other job, readable events
without pull_request_target, and a literal fleet array on every runs-on. It
pins corpus-parity.yml and docs.yml. They are deliberately not routed through
the full authz contract: corpus-parity needs persisted checkout credentials for
its private HTTPS submodule and git lfs pull, and docs deploys with Cloudflare
secrets; forcing persist-credentials: false or banning secrets there would
break them. docs.yml moves out of HOSTED_JOB_RUNNERS, which is now empty.

Refusal tests added for each mutation (authz job dropped, needs removed from
either corpus job or from docs build, one-character change to the authz
script, a hosted fallback expression, docs build back on ubuntu-latest,
pull_request_target, authz reordered or given an extra step/override), each
asserting the intended finding and the whole-workflow contract; every existing
assertion is kept. Not executed on this Mac: the PR's preflight job on
pf-gcp-pr is the proof.

Sweep of every engine workflow triggered by pull_request,
pull_request_target or workflow_run: ci.yml fully gated; corpus-parity.yml
and docs.yml were the ungated ones and are fixed here; native-live.yml has no
direct PR trigger; promote-baseline.yml's promote is pull_request_target,
ungated, and unchanged in this commit (it runs main's own copy of the file,
checks out and runs no PR code, and its WIF condition admits only
refs/heads/main) — reported to CORE-TOP rather than widened into a release
workflow.

Lane core-org-472sec (ORG-CX); diff read by the supervisor. Tests not run on
the Mac; CI is the proof.

Co-Authored-By: Claude Code <[email protected]>