Merge origin/main (v1.64.1.0 code-smell wave) into test-evals-ci-speedup

Both sides shipped overlapping test-infra work in parallel; resolutions
compose intent rather than picking sides:

- free-tests.yml (both added): keep this branch's lane (canonical
  strict-parallel runner, secretless, plain runner, ~2min) over main's
  per-file-serial container loop (45min budget, hand-curated skip list,
  needs GITHUB_TOKEN); ported main's git safe.directory insight.
- Dockerfile.ci Bun install: main discovered the installer IGNORES the
  BUN_VERSION env var (the old form silently installed latest) — main's
  arg-form mechanism + this branch's 1.3.13 target.
- parity baseline: both sides rebased after hitting the same silent
  drift; adopted main's v1.64.1.0 union-normalized fixture and dropped
  this branch's interim v1.64.0.0 capture. carve-guards caps: main's
  tighter re-ratchets win (all four).
- touchfiles: kept this branch's three-file facade split; ported main's
  pure-data removals (dead sidebar-agent entries, spec judge entry,
  ship-idempotency) into touchfiles-data.ts.
- ship-idempotency SDK variant: main deliberately removed it as
  redundant with the real-PTY test; adopted — dropped this branch's
  rehomed copy and its periodic matrix row (the zombie-monolith deletion
  stands; coverage-audit + triage rehomes verified untouched by main).
- e2e-tier-alignment: taught the new parent-mapper hard check main's
  consolidated describeE2ETier()/e2eTierEnabled() self-gate shapes (the
  helper's header names this file as a required recognizer).
- browse/test/compare-board.test.ts: quarantined behind
  GSTACK_COMPARE_BOARD_TESTS=1 — all 16 tests fail identically on
  origin/main solo on dev machines (blame protocol receipts in-file);
  main's own CI lane skip-lists it. An always-red file would block every
  PR now that free-tests is a required check.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/skill-e2e-ship-idempotency.test.ts

@@ -11,12 +11,11 @@
  *   4. Does NOT append a duplicate CHANGELOG [0.0.2] entry
  *   5. Does NOT create a new "chore: bump version" commit
  *
- * Why real-PTY: the ship-idempotency test in
- * test/skill-e2e-ship-idempotency-sdk.test.ts uses the SDK harness with a
- * synthetic prompt asking the agent to "run
- * ONLY the idempotency checks." This test exercises the actual /ship
- * skill end-to-end against a real git fixture so a regression that
- * silently re-bumps despite the check passing would be caught.
+ * Why real-PTY: the old SDK-harness ship-idempotency variant (removed in
+ * v1.64.1.0 as redundant with this test) used a synthetic prompt asking
+ * the agent to "run ONLY the idempotency checks." This test exercises the
+ * actual /ship skill end-to-end against a real git fixture so a regression
+ * that silently re-bumps despite the check passing would be caught.
  *
  * Plan-mode framing: we run /ship in plan mode so the agent cannot push,
  * commit, or open PRs. The Step 12 idempotency check is read-only
@@ -31,7 +30,8 @@
  * Cost: ~$2-4/run. Periodic tier — long, runs weekly.
  */
 
-import { describe, test, expect } from 'bun:test';
+import { test, expect } from 'bun:test';
+import { describeE2ETier } from './helpers/e2e-gate';
 import { spawnSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -42,8 +42,7 @@ import {
   isNumberedOptionListVisible,
 } from './helpers/claude-pty-runner';
 
-const shouldRun = !!process.env.EVALS && process.env.EVALS_TIER === 'periodic';
-const describeE2E = shouldRun ? describe : describe.skip;
+const describeE2E = describeE2ETier('periodic');
 
 interface ShipFixture {
   workTree: string;