Merge origin/main (v1.64.1.0 code-smell wave) into test-evals-ci-speedup

Both sides shipped overlapping test-infra work in parallel; resolutions
compose intent rather than picking sides:

- free-tests.yml (both added): keep this branch's lane (canonical
  strict-parallel runner, secretless, plain runner, ~2min) over main's
  per-file-serial container loop (45min budget, hand-curated skip list,
  needs GITHUB_TOKEN); ported main's git safe.directory insight.
- Dockerfile.ci Bun install: main discovered the installer IGNORES the
  BUN_VERSION env var (the old form silently installed latest) — main's
  arg-form mechanism + this branch's 1.3.13 target.
- parity baseline: both sides rebased after hitting the same silent
  drift; adopted main's v1.64.1.0 union-normalized fixture and dropped
  this branch's interim v1.64.0.0 capture. carve-guards caps: main's
  tighter re-ratchets win (all four).
- touchfiles: kept this branch's three-file facade split; ported main's
  pure-data removals (dead sidebar-agent entries, spec judge entry,
  ship-idempotency) into touchfiles-data.ts.
- ship-idempotency SDK variant: main deliberately removed it as
  redundant with the real-PTY test; adopted — dropped this branch's
  rehomed copy and its periodic matrix row (the zombie-monolith deletion
  stands; coverage-audit + triage rehomes verified untouched by main).
- e2e-tier-alignment: taught the new parent-mapper hard check main's
  consolidated describeE2ETier()/e2eTierEnabled() self-gate shapes (the
  helper's header names this file as a required recognizer).
- browse/test/compare-board.test.ts: quarantined behind
  GSTACK_COMPARE_BOARD_TESTS=1 — all 16 tests fail identically on
  origin/main solo on dev machines (blame protocol receipts in-file);
  main's own CI lane skip-lists it. An always-red file would block every
  PR now that free-tests is a required check.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/e2e-tier-alignment.test.ts

@@ -28,6 +28,12 @@ const TEST_DIR = import.meta.dir;
 // silently drop a file from the invariant (fail-open is the defect class
 // this test exists to kill).
 const SELF_GATE_RE = /EVALS_TIER\s*===\s*['"](gate|periodic)['"]/g;
+// Consolidated gate helper (test/helpers/e2e-gate.ts). Both regexes stay
+// active: migrated files self-gate via `describeE2ETier('<tier>')` (or the
+// boolean form `e2eTierEnabled('<tier>')`), while stragglers still using the
+// raw predicate are caught by SELF_GATE_RE above. The tier argument maps to
+// the declared tier exactly like the raw predicate's tier literal did.
+const HELPER_GATE_RE = /\b(?:describeE2ETier|e2eTierEnabled)\(\s*['"](gate|periodic)['"]/g;
 
 describe('E2E tier alignment (touchfiles declaration vs test self-gate)', () => {
   const testFiles = readdirSync(TEST_DIR)
@@ -44,6 +50,7 @@ describe('E2E tier alignment (touchfiles declaration vs test self-gate)', () =>
       const content = readFileSync(path.join(TEST_DIR, file), 'utf-8');
       const tiers = new Set<string>();
       for (const m of content.matchAll(SELF_GATE_RE)) tiers.add(m[1]);
+      for (const m of content.matchAll(HELPER_GATE_RE)) tiers.add(m[1]);
       const repoPath = `test/${file}`;
       if (tiers.size === 0) {
         // Every skill-e2e file is expected to self-gate; zero matches means
@@ -117,7 +124,11 @@ describe('E2E tier alignment (touchfiles declaration vs test self-gate)', () =>
       if (quoted.length + registered.length > 0) continue; // parent-mappable
 
       const usesNameSelection = /\b(describeIfSelected|runSkillTest|selectedTests)\b/.test(content);
-      const selfGated = /EVALS_TIER\s*===\s*['"](gate|periodic)['"]/.test(content);
+      // Both self-gate shapes count: the raw predicate and the consolidated
+      // helper (test/helpers/e2e-gate.ts documents this file as a consumer
+      // that must recognize describeE2ETier/e2eTierEnabled).
+      const selfGated = /EVALS_TIER\s*===\s*['"](gate|periodic)['"]/.test(content)
+        || /\b(?:describeE2ETier|e2eTierEnabled)\(\s*['"](gate|periodic)['"]/.test(content);
       if (!usesNameSelection && selfGated) continue; // fail-open-safe standalone
 
       invisible.push(