Merge origin/main (v1.64.1.0 code-smell wave) into test-evals-ci-speedup

Both sides shipped overlapping test-infra work in parallel; resolutions
compose intent rather than picking sides:

- free-tests.yml (both added): keep this branch's lane (canonical
  strict-parallel runner, secretless, plain runner, ~2min) over main's
  per-file-serial container loop (45min budget, hand-curated skip list,
  needs GITHUB_TOKEN); ported main's git safe.directory insight.
- Dockerfile.ci Bun install: main discovered the installer IGNORES the
  BUN_VERSION env var (the old form silently installed latest) — main's
  arg-form mechanism + this branch's 1.3.13 target.
- parity baseline: both sides rebased after hitting the same silent
  drift; adopted main's v1.64.1.0 union-normalized fixture and dropped
  this branch's interim v1.64.0.0 capture. carve-guards caps: main's
  tighter re-ratchets win (all four).
- touchfiles: kept this branch's three-file facade split; ported main's
  pure-data removals (dead sidebar-agent entries, spec judge entry,
  ship-idempotency) into touchfiles-data.ts.
- ship-idempotency SDK variant: main deliberately removed it as
  redundant with the real-PTY test; adopted — dropped this branch's
  rehomed copy and its periodic matrix row (the zombie-monolith deletion
  stands; coverage-audit + triage rehomes verified untouched by main).
- e2e-tier-alignment: taught the new parent-mapper hard check main's
  consolidated describeE2ETier()/e2eTierEnabled() self-gate shapes (the
  helper's header names this file as a required recognizer).
- browse/test/compare-board.test.ts: quarantined behind
  GSTACK_COMPARE_BOARD_TESTS=1 — all 16 tests fail identically on
  origin/main solo on dev machines (blame protocol receipts in-file);
  main's own CI lane skip-lists it. An always-red file would block every
  PR now that free-tests is a required check.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/test-paid-shards.ts

@@ -113,8 +113,11 @@ export interface TierClassification {
  *
  * Exclusion is the dangerous direction (a wrongly-skipped gate test is exactly
  * the invisible-non-execution bug this runner exists to kill), so the only
- * exclusion evidence accepted is an explicit whole-file `EVALS_TIER === '<other>'`
- * guard. Inferring a file's tier from which E2E_TIERS names appear in its source
+ * exclusion evidence accepted is an explicit whole-file tier guard: either the
+ * raw `EVALS_TIER === '<other>'` predicate or the consolidated helper form
+ * `describeE2ETier('<other>')` / `e2eTierEnabled('<other>')` from
+ * test/helpers/e2e-gate.ts (same semantics, read from env at module load).
+ * Inferring a file's tier from which E2E_TIERS names appear in its source
  * is guesswork that silently drops real work: short keys like 'retro' match
  * unrelated strings, and LLM-judge tests are keyed off LLM_JUDGE_TOUCHFILES and
  * carry no E2E_TIERS name at all. Everything without an explicit other-tier
@@ -123,10 +126,11 @@ export interface TierClassification {
 export function classifyPaidTestFile(source: string, tier: PaidTier): TierClassification {
   const other: PaidTier = tier === 'gate' ? 'periodic' : 'gate';
   const declares = (candidate: PaidTier) =>
-    new RegExp(`EVALS_TIER\\s*===\\s*['"\`]${candidate}['"\`]`).test(source);
+    new RegExp(`EVALS_TIER\\s*===\\s*['"\`]${candidate}['"\`]`).test(source) ||
+    new RegExp(`\\b(?:describeE2ETier|e2eTierEnabled)\\(\\s*['"\`]${candidate}['"\`]`).test(source);
 
-  if (declares(tier)) return { included: true, reason: `declares EVALS_TIER === '${tier}'` };
-  if (declares(other)) return { included: false, reason: `declares EVALS_TIER === '${other}' only` };
+  if (declares(tier)) return { included: true, reason: `declares tier '${tier}'` };
+  if (declares(other)) return { included: false, reason: `declares tier '${other}' only` };
   return { included: true, reason: 'no whole-file tier guard — runtime E2E_TIERS filter decides' };
 }