ci: Linux free-test lane — ~400 files get CI coverage for the first time

New required, secretless free-tests job: the canonical runner's single
'bun test --parallel' invocation with strict-output classification on
ubicloud-standard-8. The free suite previously ran on NO Linux CI — only
a curated Windows subset ran anywhere — so every 'tests pass' claim
about main rested on contributors running them locally.

Secretless by design (no API keys; fork PRs finally get real test
signal) and pinned by test/free-tests-workflow-wiring.test.ts: canonical
runner invoked, zero secrets.* references, pull_request never
pull_request_target, and matrix-count/--shards agreement if anyone
switches to the sharded fallback.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/free-tests.yml

@@ -0,0 +1,75 @@
+name: Free Tests
+
+# The free suite (~400 files: test/, browse/test/, make-pdf/test/, design/test/)
+# had ZERO Linux CI coverage before this lane — only a curated Windows subset
+# ran anywhere. This job runs the whole thing through the canonical runner
+# (scripts/test-free-shards.ts): one `bun test --parallel` invocation with
+# strict-output classification, so a truncated or summary-less run can never
+# report green.
+#
+# Deliberately SECRETLESS: free tests make no API calls, so this lane gets no
+# provider keys at all — least privilege, and fork PRs get real test signal
+# here (the eval matrix skips fork PRs because repository secrets can't reach
+# them). test/free-tests-workflow-wiring.test.ts fails CI if a secret sneaks in.
+#
+# This is a REQUIRED check from day one (branch protection lists it). If it's
+# red, fix or quarantine-with-issue — don't make it advisory; an advisory lane
+# is permanent false comfort.
+#
+# Sizing note (decision V3): single --parallel job first. If PR runs show it
+# slower than the eval matrix wall, switch to a matrix of
+# `--shards N --shard i` jobs (indices are stable, empty shards no-op).
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: free-tests-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  free-tests:
+    runs-on: ubicloud-standard-8
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.13
+
+      - uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: linux-bun-${{ hashFiles('bun.lock') }}
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: linux-playwright-${{ hashFiles('bun.lock') }}
+
+      # Cache restores browser binaries; install is still required for system
+      # deps and is a fast no-op for already-present browsers.
+      - name: Install Playwright Chromium
+        run: npx playwright install --with-deps chromium
+
+      - name: Configure git identity (tests init temp repos)
+        run: |
+          git config --global user.email "free-tests-ci@gstack.test"
+          git config --global user.name "Free Tests CI"
+          git config --global init.defaultBranch main
+
+      - name: Generate host SKILL.md outputs (.agents, .factory)
+        # Golden-file tests read generated host outputs that are gitignored.
+        run: bun run gen:skill-docs --host all
+
+      - name: Build server-node bundle (loaded by browse cli imports)
+        run: bash browse/scripts/build-node-server.sh
+
+      - name: Run free suite
+        run: bun run test:free