fix(ci): free-tests lane actually runs the make-pdf e2e gates

The 9 make-pdf/test/e2e gate tests probe make-pdf/dist/pdf,
browse/dist/browse, and the diagram-render bundle, then self-skip when
absent. The required free-tests lane never built any of them, so the
gates silently skipped on Linux for their entire life (verified: 9 of
14 skip, exit 0). make-pdf-gate.yml's justification for deleting its
Linux leg claimed the free lane covered this — it didn't.

- new build:gates script: exactly the three artifacts the gates probe
  (full bun run build compiles five binaries; ~60-90s tax on the only
  required check is not warranted)
- free-tests.yml: build:gates step + poppler-utils +
  fonts-noto-color-emoji (fonts must precede the first browse daemon
  launch — Chromium snapshots fontconfig at startup; verified live:
  a warm daemon renders tofu, a fresh one embeds NotoColorEmoji)
- make-pdf/test/e2e/ci-prereqs.test.ts: GSTACK_EXPECT_BINARIES=1 (set
  by the workflow) inverts the skip polarity in CI — dropping the
  build step or poppler fails the lane instead of re-opening the
  silent-skip hole

Pre-flight: all 9 gates green on Linux locally.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/free-tests.yml

@@ -82,9 +82,14 @@ jobs:
       # Headed-browser tests (handoff, extension sidepanel DOM) need a real
       # DISPLAY — first Linux run failed with Playwright's "launched a headed
       # browser without an XServer" banner. xvfb-run below provides it;
-      # x11-utils ships xdpyinfo for display probing.
-      - name: Install Xvfb + X11 utilities
-        run: sudo apt-get install -y --no-install-recommends xvfb x11-utils
+      # x11-utils ships xdpyinfo for display probing. poppler-utils ships
+      # pdftotext/pdffonts/pdftoppm for the make-pdf e2e gates;
+      # fonts-noto-color-emoji is the emoji-gate's render font (playwright
+      # --with-deps usually installs it, but the gate must not depend on a
+      # transitive package list). Fonts must land BEFORE the first browse
+      # daemon launch — Chromium snapshots fontconfig at startup.
+      - name: Install Xvfb + X11 utilities + gate tools
+        run: sudo apt-get install -y --no-install-recommends xvfb x11-utils poppler-utils fonts-noto-color-emoji
 
       - name: Configure git identity (tests init temp repos)
         run: |
@@ -108,8 +113,22 @@ jobs:
       - name: Build server-node bundle (loaded by browse cli imports)
         run: bash browse/scripts/build-node-server.sh
 
+      # Narrowed gate build: the make-pdf e2e gates probe make-pdf/dist/pdf,
+      # browse/dist/browse, and the diagram-render bundle, then self-skip when
+      # absent — which made them silently skip on Linux for their whole life
+      # (this lane never built binaries). Full `bun run build` compiles five
+      # binaries and would add ~60-90s to the ONLY required check; the gates
+      # need exactly these three artifacts.
+      - name: Build gate binaries (make-pdf e2e gates)
+        run: bun run build:gates
+
+      # GSTACK_EXPECT_BINARIES=1 arms make-pdf/test/e2e/ci-prereqs.test.ts:
+      # if a future edit drops the gate build (or poppler), the lane FAILS
+      # instead of the gates silently self-skipping back to false green.
       - name: Run free suite
         run: xvfb-run -a bun run test:free
+        env:
+          GSTACK_EXPECT_BINARIES: "1"
 
       # The runner streams the full child output to per-run logs under the OS
       # tmpdir and prints only the quiet contract to the console. Without this

.github/workflows/make-pdf-gate.yml

@@ -24,10 +24,12 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # macOS only: the Linux leg became redundant when the free-tests lane
-        # started running make-pdf/test (incl. e2e/) on every PR via the
-        # canonical runner — this gate's remaining value is macOS rendering
-        # coverage on make-pdf-scoped changes.
+        # macOS only: the Linux leg is covered by the free-tests lane, which
+        # builds the gate binaries (build:gates) and runs make-pdf/test
+        # (incl. e2e/) on every PR via the canonical runner, with
+        # GSTACK_EXPECT_BINARIES=1 arming ci-prereqs.test.ts so the gates
+        # can never silently self-skip there again. This gate's remaining
+        # value is macOS rendering coverage on make-pdf-scoped changes.
         os: [macos-latest]
         # Windows is tolerant-mode — Xpdf / Poppler-Windows extraction
         # differs enough from the Linux/macOS baseline that the strict