ci: teach main's admission rules and classifier the arm PR leg - #702

…as two exact variants (#704)

Main-side half of the arm PR leg. The GKE PR workflow runs main's admission rules and main's docs-only classifier against a pull request's workflows (pull_request_target), so a workflow change that adds a job can only pass once main already knows that job's exact shape. This change teaches main both halves, ahead of the workflow change itself:

- scripts/ci_docs_only.py: the classifier also answers whether a change is arm-relevant (an arm_relevant output).
- scripts/ci_preflight.py: the admission rules accept exactly the two new shapes (the optional build-arm job with its pinned label and outputs, and the matching admit/legs/result checks); any other added job in the privileged workflow is still rejected.
- Tests for both, written red-first, plus the docs/ci.md rows.

Security: the new rules admit only those exact shapes; no wider pattern lets a later pull request add other jobs to the privileged workflow.

Known limit (follow-up): the admission entry does not yet check env, shell, working-directory or continue-on-error on build and build-debug.

Deferred to the workflow change that follows: the real-file arm proof tests, the actual-workflow allowlist and actionlint tests, the arm inventory and aggregate expansions, independent arm-read execution tests, and the docs rows for the build-arm leg itself.

🤖 Generated with [Claude Code](https://claude.com/claude-code)


Replaces #702 as one commit whose message names the six docs/ci.md sentences it removes (the docs-revert check judges each commit by its own message). Same tree as #702.


## Commits

- 5a53e8a ci: teach main's GKE admission rules the arm leg of the PR workflow, as two exact variants
  
  The PR workflow's admit job runs main's admission rules on the pull request's own gke-pr.yml before any privileged leg runs. A PR that adds the arm64 leg (a build-arm job, an arm_relevant admit output, and matching legs and result checks) is refused by those rules, and the base checker's ci_docs_only.py does not publish arm_relevant, so the new result check would also fail with an unanswered classification.
  
  This change is the main-side half of that PR and does not touch gke-pr.yml:
  
  - ci_docs_only.py publishes arm_relevant (true for sources, build inputs and test scripts and for any path it cannot classify; false for established docs-only and .github-only changes), with its tests.
  - ci_preflight.py admits exactly two shapes of gke-pr.yml. The shape that has no build-arm job is checked by the unchanged rules. The shape that defines build-arm is checked by the full new rule set: the job inventory, the arm_relevant output, the pinned arm64 label, the path policy, the exact setup and Debug steps, and the complete legs and result gate bodies. The two sets are selected together by the job definition and never mixed, so a hybrid, a second arm job, an extra job in either shape, another label, or a container, services, credentials or timeout on the arm job match neither shape and are refused. In the arm shape, continue-on-error anywhere in the arm job and env, shell or working-directory on any arm step are refused too.
  - test_ci_preflight.py runs the real rules against main's current workflow and the same workflow with the arm leg applied, and asserts the exact findings of each refusal control.
  - docs/ci.md documents the classifier and both admission variants without changing the file's line count. Its rewritten sentences are named here, as the documentation check for unnamed sentence deletions (introduced by f85ce18) requires: "First merge the checker or allow-table change while the existing workflows pass." and "Then merge the workflow change that uses the newly admitted rule or label." and "Rule and table changes land in two steps." and "This order prevents one pull request from changing both sides of admission." are now one sentence (rule and table changes land first while existing workflows pass, workflow changes follow, so one PR cannot change both sides of admission); "The classifier uses exact `.github/` and `docs/` prefixes, so lookalike directories and the classifier itself cannot create a skip." and "Renames contribute both names; empty, missing, malformed, truncated or unreadable lists are neither class." are folded into the shorter paragraph that describes the path file and the exact prefixes, with the new arm_relevant output described beside it.
  
  Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
- 62fd39f Merge main (c3d3159) into the admission-rule branch
  
  The strict ruleset requires the branch to contain current main. The only change main gained since the branch base is README.md; no file of this branch is touched by the merge.
  
  Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

## Merge note

Merged on the engine merge gate for this exact head. pineforge/verify: CARRY (preflight and docs on the head tree 416b004, captured after the head commit; the other six steps carried from the full verify of tree 0ba6e76, all passed). pineforge/parity: CARRY of the full parity sweep of 0ba6e76 paired with codegen main; the head delta is one documentation file (README.md, from the main merge). Sweep result: comparable 7989, coverage lost 0, both bands +0/-0, hard regressions 0, hard moves 0, leavers 0.

Co-Authored-By: Claude Opus 5.5 <[email protected]>