Merge origin/main (v1.64.1.0 code-smell wave) into test-evals-ci-speedup

Both sides shipped overlapping test-infra work in parallel; resolutions
compose intent rather than picking sides:

- free-tests.yml (both added): keep this branch's lane (canonical
  strict-parallel runner, secretless, plain runner, ~2min) over main's
  per-file-serial container loop (45min budget, hand-curated skip list,
  needs GITHUB_TOKEN); ported main's git safe.directory insight.
- Dockerfile.ci Bun install: main discovered the installer IGNORES the
  BUN_VERSION env var (the old form silently installed latest) — main's
  arg-form mechanism + this branch's 1.3.13 target.
- parity baseline: both sides rebased after hitting the same silent
  drift; adopted main's v1.64.1.0 union-normalized fixture and dropped
  this branch's interim v1.64.0.0 capture. carve-guards caps: main's
  tighter re-ratchets win (all four).
- touchfiles: kept this branch's three-file facade split; ported main's
  pure-data removals (dead sidebar-agent entries, spec judge entry,
  ship-idempotency) into touchfiles-data.ts.
- ship-idempotency SDK variant: main deliberately removed it as
  redundant with the real-PTY test; adopted — dropped this branch's
  rehomed copy and its periodic matrix row (the zombie-monolith deletion
  stands; coverage-audit + triage rehomes verified untouched by main).
- e2e-tier-alignment: taught the new parent-mapper hard check main's
  consolidated describeE2ETier()/e2eTierEnabled() self-gate shapes (the
  helper's header names this file as a required recognizer).
- browse/test/compare-board.test.ts: quarantined behind
  GSTACK_COMPARE_BOARD_TESTS=1 — all 16 tests fail identically on
  origin/main solo on dev machines (blame protocol receipts in-file);
  main's own CI lane skip-lists it. An always-red file would block every
  PR now that free-tests is a required check.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/evals-periodic.yml

@@ -91,11 +91,6 @@ jobs:
           # here; an all-skip shard would just burn a container boot weekly.
           - name: e2e-workflow
             file: test/skill-e2e-workflow.test.ts
-          # Rehomed from the deleted pre-split monolith: the SDK-harness
-          # ship-idempotency check (periodic; the real-PTY variant runs via
-          # the periodic sharded runner).
-          - name: e2e-ship-idempotency-sdk
-            file: test/skill-e2e-ship-idempotency-sdk.test.ts
           - name: e2e-routing
             file: test/skill-routing-e2e.test.ts
           - name: e2e-codex

.github/workflows/free-tests.yml

@@ -63,6 +63,9 @@ jobs:
           git config --global user.email "free-tests-ci@gstack.test"
           git config --global user.name "Free Tests CI"
           git config --global init.defaultBranch main
+          # Some tests run git against the checkout itself; CI checkouts can be
+          # owned by a different uid than the runner user.
+          git config --global --add safe.directory '*'
 
       - name: Generate host SKILL.md outputs (.agents, .factory)
         # Golden-file tests read generated host outputs that are gitignored.

.github/workflows/skill-docs.yml

@@ -20,27 +20,32 @@ jobs:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
       - run: bun install
-      - name: Check Claude host freshness
-        run: bun run gen:skill-docs
-      - name: Verify Claude skill docs are fresh
+      # One generation pass for ALL 10 hosts. gen-skill-docs --host all
+      # hard-fails on any per-host generation error (scripts/gen-skill-docs.ts
+      # aggregates failures and exits non-zero), so every host is gated on
+      # "generates cleanly." Known limitation, on purpose: the 9 gitignored
+      # host outputs (.agents/, .factory/, .kiro/, ...) are NOT byte-freshness
+      # checked — `git diff` on ignored untracked paths is always empty (the
+      # previous per-host `git diff -- .agents/` gates could never fail for
+      # exactly that reason). Byte-freshness is enforced only for tracked
+      # output (the Claude SKILL.md files), which the two steps below cover.
+      - name: Generate all host skill docs
+        run: bun run gen:skill-docs --host all
+      - name: Verify tracked skill docs are fresh
         run: |
           git diff --exit-code || {
-            echo "Generated SKILL.md files are stale. Run: bun run gen:skill-docs"
+            echo "Generated SKILL.md files are stale. Run: bun run gen:skill-docs --host all"
             exit 1
           }
-      - name: Check Codex host freshness
-        run: bun run gen:skill-docs --host codex
-      - name: Verify Codex skill docs are fresh
+      # git diff misses NEW untracked files (e.g. a freshly added skill whose
+      # generated SKILL.md was never committed). Fail on any untracked stray
+      # the generator produced outside the gitignored host dirs.
+      - name: Verify no untracked generated files
         run: |
-          git diff --exit-code -- .agents/ || {
-            echo "Generated Codex SKILL.md files are stale. Run: bun run gen:skill-docs --host codex"
+          STRAYS=$(git status --porcelain --untracked-files=all | grep '^??' || true)
+          if [ -n "$STRAYS" ]; then
+            echo "Generator produced untracked files that are neither committed nor gitignored:"
+            echo "$STRAYS"
+            echo "Commit them (bun run gen:skill-docs --host all) or gitignore them."
             exit 1
-          }
-      - name: Generate Factory skill docs
-        run: bun run gen:skill-docs --host factory
-      - name: Verify Factory skill docs are fresh
-        run: |
-          git diff --exit-code -- .factory/ || {
-            echo "Generated Factory SKILL.md files are stale. Run: bun run gen:skill-docs --host factory"
-            exit 1
-          }
+          fi