CI: restore fast artifact reuse and shard conformance suites

[brandonpayton]

Why

Staging and prepare-merge were spending much of their critical path rebuilding browser assets that had already been fetched, then running the two longest conformance suites as single jobs.

In the reported run, the shared preparation job took 24m31s. Its browser-preparation step alone took 16m10s even though the preceding fetch-only materialization had already downloaded the package archives. The generic resolver was treating ZIP files, runtime data, virtual file system (VFS) images, and WebAssembly side modules as if each were an executable Wasm program. Those valid non-executable artifacts failed executable-only checks and were rebuilt.

The same run then spent 9m30s in libc-test and 22m56s in Sortix. Because each suite was one job, no additional runner could shorten either wait.

What changed

• Validate each resolved artifact according to its declared kind. Executable .wasm files remain fail closed for application binary interface (ABI), exports, legacy Asyncify, and fork instrumentation. VFS images receive VFS metadata and ABI validation. Authenticated archives, runtime data, and .so side modules no longer receive executable-Wasm policy.
• Keep the TypeScript and shell resolvers aligned, including fail-closed handling for malformed executable Wasm and VFS candidates.
• Reduce shared preparation to artifacts every runtime suite consumes. Browser-only VFS construction now runs in the browser consumer against the exact already-materialized package tree with --fetch-only, so missing package content fails instead of starting a broad source rebuild.
• Retain all required example/benchmark fixtures and the already-built package resolver in the prepared archive. The archive test verifies both contents and executable mode after extraction.
• Start source/host validation, Cargo kernel tests, and fork-instrument tests while package preparation is still running.
• Split libc-test into functional + regression and math jobs.
• Split Sortix into include, basic, and remaining runtime jobs.
• Pass shard routing explicitly through the dev shell, whose clean environment intentionally drops undeclared variables.
• Lock the exact eight-row staging and prepare-merge test topology in regression coverage so a missing shard cannot silently reduce coverage.

Measured CI effect

The final PR run passed at 11acf8999 and included four package-staging jobs triggered by this PR's resolver changes.

Signal	Reported run	Final PR run	Change
Shared preparation job	24m31s	5m53s	18m38s faster (76%)
Longest libc suite step	9m30s	5m49s	3m41s faster (39%)
Longest Sortix suite step	22m56s	10m48s	12m08s faster (53%)
Full staging workflow	56m09s	35m56s	20m13s faster (36%)

Sharding trades additional concurrent runner setup for lower wall-clock latency; it does not claim to reduce total compute. Browser-only preparation also makes the browser job longer, but removes that work from the shared barrier so every suite starts sooner. The final browser and longest Sortix shard completed within six seconds of each other, so neither left a large idle tail.

Homebrew migration review

The suspected regression commit landed during the Homebrew migration, but it changed the generic resolver guard rather than Homebrew-specific files. This PR does not change Homebrew publisher or validator code. scripts/homebrew-validate-wasm-executable.sh keeps strict executable-Wasm validation, and the staging run's Homebrew publisher trust, sidecar, and pour-planning checks all passed.

A migration review should focus on the boundary clarified here: declared .so, archive, VFS, and runtime-data package outputs are authenticated package content, but they are not standalone executable Wasm programs and must not be checked as such.

Validation

• Staging run 29470012856: all eight runtime jobs, cargo-kernel, fork-instrument, resolver/package validation, package staging, and the aggregate test gate passed.
• Browser smoke run 29470012876: passed on final HEAD; 34 Chromium tests and 57 cross-browser contract tests also passed in staging.
• bash scripts/dev-shell.sh bash tests/scripts/ci-run-test-suite-groups.test.sh
• bash scripts/dev-shell.sh bash tests/scripts/package-publish-flow.sh
• bash scripts/dev-shell.sh bash .github/scripts/test-merge-candidate-workflows.sh
• bash scripts/dev-shell.sh bash .github/actions/detect-change-scope/test-ci-scope-paths.sh
• bash scripts/dev-shell.sh bash scripts/test-wasm-artifact-guards.sh
• bash scripts/dev-shell.sh npx --prefix host vitest run --root . tests/package-system — 58 tests passed
• bash scripts/dev-shell.sh npx --prefix host vitest run --root . tests/package-system/resolve-binary.test.ts host/test/binary-resolver.test.ts — 21 tests passed
• bash scripts/dev-shell.sh npm --prefix host run typecheck
• Bash/Node syntax checks and git diff --check

Prepare-merge was not triggered because this PR does not have the ready-to-ship label. Its matching shard matrix and preparation path are covered by the workflow contract and topology tests above.

[github-actions]

Phase B-1 matrix build status — pr-963-staging

ABI v39. 4 built, 0 failed, 4 total.

Package	Arch	Status	Sha
shell	wasm32	built	4ee7ef0a
lamp	wasm32	built	876e3abc
node-vfs	wasm32	built	acab7f89
wordpress	wasm32	built	71f6f607

_{Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.}

[brandonpayton]

Cross-PR workflow dependency: current head 11acf8999bda7e5c21142789fe3abc8c1d1ab5f9 still checks out write-authorized candidate lifecycle helpers from ${{ needs.synthesize-merge.outputs.head_sha }}. That is the exact control-plane defect reproduced by #934 and fixed in #964.

After #964 lands, please rebase #963 onto current main and preserve #964's ${{ needs.synthesize-merge.outputs.base_sha }} checkout plus its workflow-contract assertion. Resolving the overlapping prepare-merge.yml changes back to head_sha would reintroduce the failure for older PR heads.

[github-actions]

prepare-merge: test-gate passed against the synthetic PR merge and sealed merge-candidate-abi-v39-pr-963-run-29502953828-attempt-1. The canonical ABI index is unchanged. merge-gate=success was posted on PR HEAD. This PR is ready for a reviewer to squash merge; default-branch reconciliation will verify the exact merged tree before activation.