ci: split and shard the desktop lanes, and fix a dead path filter - #118

Desktop Core was the CI critical path at ~29 minutes across the last
dozen runs, while the next-longest job finished in 7m36s. It ran the
frontend checks and the Tauri Rust checks back to back in one lane, so
every desktop PR waited on the sum.

Disabling the lane outright would have removed the only CI run of
`just desktop-check` (biome + the zoom-safe px-text and pubkey-truncation
guards) and `just desktop-test`, and the only run anywhere of
`just desktop-tauri-test-compiled-flags`, which verifies the owner-only
agent-access capability and the auto-connect flag in both compiled
states. Pre-push hooks cover some of that but are bypassable, absent on
web edits, and never ran the compiled-flag matrix at all.

Split into three lanes that run in parallel instead, keeping every check:

- Desktop Core — lint/format, unit tests, frontend build. Pure
  TypeScript, so it no longer installs the Tauri Linux deps, mold, or the
  Rust cache. ~6 minutes.
- Desktop Tauri — clippy, check, tests. ~8 minutes.
- Desktop Tauri Compiled Flags — the compiled-flag matrix, which was
  15m11s of the old lane's 28m59s because each permutation forces a full
  rebuild through `build.rs`'s rerun-if-env-changed.

Both Tauri lanes need the frontend built first because
`tauri_build::try_build` resolves `frontendDist` (`../dist`), and they
share one `rust-cache` entry via `shared-key` rather than each keying on
their own job id. Only Desktop Core saves the pnpm store, so three
concurrent saves of one key cannot race.

The `desktop` aggregator now requires all three to succeed — no `skipped`
tolerance, since none of them is disabled — and `ci-complete` gains the
two new lanes. The dead `Upload desktop e2e artifacts` step is dropped:
this lane has never run Playwright, so it had nothing to upload.

Desktop critical path drops from ~29 minutes to ~17, with no loss of
coverage.

Signed-off-by: Junchao Yan <[email protected]>

On its own lane the compiled-flag matrix took 33m40s on PR #118, longer
than the old combined Desktop Core lane it was split out of, so it was
still the desktop critical path. Turn it off the same way the smoke E2E
shards are turned off (if: false, original condition kept in a comment)
and let the Desktop aggregator accept its skipped result.

Desktop Core (~6m) and Desktop Tauri (~11m) stay on. Nothing else runs
`just desktop-tauri-test-compiled-flags`, so the lefthook comment now
says to run it by hand when touching a compiled flag.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Signed-off-by: Junchao Yan <[email protected]>

Round-1 post-approval review found that forcing
`desktop-tauri-compiled-flags` to `false` leaves nothing in CI or the
pre-push hook compiling a `BUZZ_BUILD_*`-set build. The three flag
assertions are `#[ignore]`d, so `just desktop-tauri-test`'s
`cargo test --workspace` never reaches them, and the flag-sensitive
non-ignored tests only ever run in the default state.

The lane was disabled because it was slow. Reading the step log of the
one run it completed (33604032432, 19m56s cold) shows where the time
actually went, and it is not recompilation:

- 3 × the full 3141-test desktop lib suite: 193.8s + 193.1s + 189.4s,
  about 9m36s of the 20.
- 4 recompiles of the Tauri crate at roughly 1 minute each.

So the fix is to stop running the states in sequence, and to stop running
one of them at all:

- `just desktop-tauri-test-compiled-flags-state <state>` verifies one
  compile state. `probes` (both flag assertions in the clean state plus
  auto-connect set), `owner-only`, and `demo-slug`. The state list lives
  once, in the `compiled_flag_states` Justfile variable; the aggregate
  `desktop-tauri-test-compiled-flags` iterates it, so the local and manual
  entry point still runs everything.
- CI runs one job per state as a `fail-fast: false` matrix. The states
  compile and test concurrently rather than serially, so the lane's wall
  clock becomes its slowest single state, not their sum.
- The clean-state `cargo test --lib` is dropped. `just desktop-tauri-test`
  already runs that suite as `cargo test --workspace` with no flag set,
  and the flag-sensitive non-ignored tests resolve an absent expectation
  to exactly the value an explicit `false` gives them — see
  `expected_owner_only` in managed_agents/runtime/test_fixtures.rs and
  `current_build_deploy_payload_forwards_compiled_policy` in
  commands/agents_tests.rs. It was ~3m15s of duplicated test runtime.

The `desktop` aggregator goes back to requiring strict `success` from this
lane; a matrix job's result is `success` only when every shard passed.
Coverage is identical to the pre-disable recipe minus the duplicated run.

Signed-off-by: Junchao Yan <[email protected]>

The Justfile advertised `compiled_flag_states` as the single source of
truth for the compiled build states, but `ci.yml` repeated the three
literals and nothing compared them. Adding a fourth state would have made
the aggregate recipe run it locally while CI kept spawning only the
original three, with `Desktop` and `CI Complete` still green — a silent
coverage loss on a security-sensitive check.

The `changes` job now reads the list with
`just --evaluate compiled_flag_states`, converts it to JSON, and exposes
it as an output; `desktop-tauri-compiled-flags` builds its matrix from
that output. The workflow no longer names any state, so the Justfile
variable is genuinely the only place the set is written.

Fail-closed in both directions: an empty list is an explicit error rather
than a matrix with no shards, and a state name the recipe does not
recognise still hits the recipe's `*)` branch and fails its shard.

`changes` gets `timeout-minutes: 5` instead of 2. It now invokes `just`,
which Hermit downloads on first use in that job, and every other lane
depends on this one — a marginal timeout here would fail the whole run.

Signed-off-by: Junchao Yan <[email protected]>

The `rust` paths-filter group named lowercase `justfile`; the repository
file is `Justfile`. The pinned dorny/paths-filter builds its matcher with
`{dot: true}` and nothing else, and picomatch defaults `nocase` to false,
so the pattern matched nothing. Verified against the pinned versions:
`src/filter.ts` at ceb8a2b sets `MatchOptions = {dot: true}`, its
package.json pins picomatch ^2.3.1, and picomatch 2.3.1 with those options
returns false for `justfile` against `Justfile`.

The consequence is specific to the guarantee the previous commit added: a
pull request whose only change is `Justfile` — adding a state to
`compiled_flag_states`, exactly the maintenance path that list exists for
— set no filter output at all. The compiled-flags matrix was skipped by
its job condition, `Desktop` was skipped with it, and `CI Complete`
accepts skipped, so the new state could merge without its shard ever
running.

`scripts/test-path-filter-contract.sh` stops this recurring. It asserts
that every non-negated pattern in every filter group corresponds to
something in the repository: a pattern with no glob metacharacters must
name a tracked path exactly, and a glob must match at least one tracked
file. Globs are matched permissively, so only a pattern that corresponds
to nothing at all can fail. A case mismatch is reported as one, naming the
path the repository actually has.

The script self-tests before it checks anything, because a contract that
cannot fail is not a contract: it asserts that an absent literal path is
rejected, and that the lowercased form of a real mixed-case tracked file
is both rejected and reported as a case mismatch. Run against the filter
before this commit's one-line fix it reports:

    rust: 'justfile' - case mismatch: the repository has 'Justfile'

It runs in `changes` alongside the other contract steps, which is also
where the mis-cased pattern was read.

Note that Justfile-only pull requests now correctly trigger the rust
lanes, which they have not been doing. That is the entry's original
intent, not an expansion of it.

Signed-off-by: Junchao Yan <[email protected]>