Merge origin/main (v1.64.1.0 code-smell wave) into test-evals-ci-speedup

Both sides shipped overlapping test-infra work in parallel; resolutions
compose intent rather than picking sides:

- free-tests.yml (both added): keep this branch's lane (canonical
  strict-parallel runner, secretless, plain runner, ~2min) over main's
  per-file-serial container loop (45min budget, hand-curated skip list,
  needs GITHUB_TOKEN); ported main's git safe.directory insight.
- Dockerfile.ci Bun install: main discovered the installer IGNORES the
  BUN_VERSION env var (the old form silently installed latest) — main's
  arg-form mechanism + this branch's 1.3.13 target.
- parity baseline: both sides rebased after hitting the same silent
  drift; adopted main's v1.64.1.0 union-normalized fixture and dropped
  this branch's interim v1.64.0.0 capture. carve-guards caps: main's
  tighter re-ratchets win (all four).
- touchfiles: kept this branch's three-file facade split; ported main's
  pure-data removals (dead sidebar-agent entries, spec judge entry,
  ship-idempotency) into touchfiles-data.ts.
- ship-idempotency SDK variant: main deliberately removed it as
  redundant with the real-PTY test; adopted — dropped this branch's
  rehomed copy and its periodic matrix row (the zombie-monolith deletion
  stands; coverage-audit + triage rehomes verified untouched by main).
- e2e-tier-alignment: taught the new parent-mapper hard check main's
  consolidated describeE2ETier()/e2eTierEnabled() self-gate shapes (the
  helper's header names this file as a required recognizer).
- browse/test/compare-board.test.ts: quarantined behind
  GSTACK_COMPARE_BOARD_TESTS=1 — all 16 tests fail identically on
  origin/main solo on dev machines (blame protocol receipts in-file);
  main's own CI lane skip-lists it. An always-red file would block every
  PR now that free-tests is a required check.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/docker/Dockerfile.ci

@@ -28,9 +28,13 @@ RUN printf 'Acquire::Retries "5";\nAcquire::http::Timeout "30";\nAcquire::https:
 
 # System deps (retry apt-get update + install as a unit — even Hetzner can blip).
 # Includes xz-utils so the Node.js .tar.xz download below can decompress.
+# python3: bin/gstack-jsonl-merge, gstack-brain-sync, gstack-detach, and other
+#   bash bins shell out to it (macOS ships python3; the base image doesn't).
+# file: skill-validation's no-compiled-binaries-in-git check runs `file --mime-type`.
+# poppler-utils: make-pdf's e2e gates hard-require pdftotext/pdffonts/pdfinfo in CI.
 RUN for i in 1 2 3; do \
       apt-get update && apt-get install -y --no-install-recommends \
-        git curl unzip xz-utils ca-certificates jq bc gpg && break || \
+        git curl unzip xz-utils ca-certificates jq bc gpg python3 file poppler-utils && break || \
       (echo "apt retry $i/3 after failure"; sleep 10); \
     done \
     && rm -rf /var/lib/apt/lists/*
@@ -61,10 +65,14 @@ RUN curl --retry 5 --retry-delay 5 --retry-connrefused -fsSL "https://nodejs.org
     && node --version \
     && npm --version
 
-# Bun (install to /usr/local so non-root users can access it)
+# Bun (install to /usr/local so non-root users can access it).
+# The version MUST be passed as a positional arg — bun.sh/install ignores a
+# BUN_VERSION env var, so the old `| BUN_VERSION=x.y.z bash` form silently
+# installed latest on every image rebuild (observed: 1.3.13/1.3.14 drift vs
+# the 1.3.10 devs run locally).
 ENV BUN_INSTALL="/usr/local"
 RUN curl --retry 5 --retry-delay 5 --retry-connrefused -fsSL https://bun.sh/install \
-    | BUN_VERSION=1.3.13 bash
+    | bash -s "bun-v1.3.13"
 
 # Claude CLI
 RUN npm i -g @anthropic-ai/claude-code
@@ -82,8 +90,10 @@ RUN npx playwright install-deps chromium
 # (headed-xvfb, headed-orphan-cleanup) can exercise the Linux container
 # auto-spawn path on every CI run. Without Xvfb in the image, the most
 # common production --headed path goes untested.
+# fonts-noto-color-emoji: the make-pdf emoji render gate needs a color-emoji
+# fallback font (mirrors make-pdf-gate.yml's Ubuntu setup step).
 RUN for i in 1 2 3; do \
-      apt-get update && apt-get install -y --no-install-recommends fonts-liberation fontconfig xvfb x11-utils && break || \
+      apt-get update && apt-get install -y --no-install-recommends fonts-liberation fonts-noto-color-emoji fontconfig xvfb x11-utils && break || \
       (echo "fonts-liberation install retry $i/3"; sleep 10); \
     done \
     && fc-cache -f \
@@ -105,6 +115,7 @@ RUN npx playwright install chromium \
 
 # Verify everything works
 RUN bun --version && node --version && claude --version && jq --version && gh --version \
+    && python3 --version && command -v file && command -v pdftotext && command -v pdffonts && command -v pdfinfo \
     && npx playwright --version \
     && fc-match "Liberation Sans" | grep -qi "Liberation" \
         || (echo "ERROR: fonts-liberation not installed — make-pdf PDFs will render in DejaVu Sans" && exit 1)

.github/workflows/evals-periodic.yml

@@ -91,11 +91,6 @@ jobs:
           # here; an all-skip shard would just burn a container boot weekly.
           - name: e2e-workflow
             file: test/skill-e2e-workflow.test.ts
-          # Rehomed from the deleted pre-split monolith: the SDK-harness
-          # ship-idempotency check (periodic; the real-PTY variant runs via
-          # the periodic sharded runner).
-          - name: e2e-ship-idempotency-sdk
-            file: test/skill-e2e-ship-idempotency-sdk.test.ts
           - name: e2e-routing
             file: test/skill-routing-e2e.test.ts
           - name: e2e-codex

.github/workflows/free-tests.yml

@@ -63,6 +63,9 @@ jobs:
           git config --global user.email "free-tests-ci@gstack.test"
           git config --global user.name "Free Tests CI"
           git config --global init.defaultBranch main
+          # Some tests run git against the checkout itself; CI checkouts can be
+          # owned by a different uid than the runner user.
+          git config --global --add safe.directory '*'
 
       - name: Generate host SKILL.md outputs (.agents, .factory)
         # Golden-file tests read generated host outputs that are gitignored.

.github/workflows/skill-docs.yml

@@ -20,27 +20,32 @@ jobs:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
       - run: bun install
-      - name: Check Claude host freshness
-        run: bun run gen:skill-docs
-      - name: Verify Claude skill docs are fresh
+      # One generation pass for ALL 10 hosts. gen-skill-docs --host all
+      # hard-fails on any per-host generation error (scripts/gen-skill-docs.ts
+      # aggregates failures and exits non-zero), so every host is gated on
+      # "generates cleanly." Known limitation, on purpose: the 9 gitignored
+      # host outputs (.agents/, .factory/, .kiro/, ...) are NOT byte-freshness
+      # checked — `git diff` on ignored untracked paths is always empty (the
+      # previous per-host `git diff -- .agents/` gates could never fail for
+      # exactly that reason). Byte-freshness is enforced only for tracked
+      # output (the Claude SKILL.md files), which the two steps below cover.
+      - name: Generate all host skill docs
+        run: bun run gen:skill-docs --host all
+      - name: Verify tracked skill docs are fresh
         run: |
           git diff --exit-code || {
-            echo "Generated SKILL.md files are stale. Run: bun run gen:skill-docs"
+            echo "Generated SKILL.md files are stale. Run: bun run gen:skill-docs --host all"
             exit 1
           }
-      - name: Check Codex host freshness
-        run: bun run gen:skill-docs --host codex
-      - name: Verify Codex skill docs are fresh
+      # git diff misses NEW untracked files (e.g. a freshly added skill whose
+      # generated SKILL.md was never committed). Fail on any untracked stray
+      # the generator produced outside the gitignored host dirs.
+      - name: Verify no untracked generated files
         run: |
-          git diff --exit-code -- .agents/ || {
-            echo "Generated Codex SKILL.md files are stale. Run: bun run gen:skill-docs --host codex"
+          STRAYS=$(git status --porcelain --untracked-files=all | grep '^??' || true)
+          if [ -n "$STRAYS" ]; then
+            echo "Generator produced untracked files that are neither committed nor gitignored:"
+            echo "$STRAYS"
+            echo "Commit them (bun run gen:skill-docs --host all) or gitignore them."
             exit 1
-          }
-      - name: Generate Factory skill docs
-        run: bun run gen:skill-docs --host factory
-      - name: Verify Factory skill docs are fresh
-        run: |
-          git diff --exit-code -- .factory/ || {
-            echo "Generated Factory SKILL.md files are stale. Run: bun run gen:skill-docs --host factory"
-            exit 1
-          }
+          fi