fix(ci): fail dependency isolation on cargo tree errors

[gabrik]

Closes #528; tracked in #529.

Problem

The CI Dependency isolation step ran cargo tree --no-dev inside an if ... | grep -q pipeline with stderr suppressed. On the pinned nightly-2026-02-08 toolchain that argument is unsupported: Cargo exits1 with error: unexpected argument '--no-dev' found, the pipeline treats the empty graph as a negative match, and the step prints Dependency isolation: OK without querying any dependencies.

Change

• scripts/check-dependency-isolation.sh: queries cargo tree --edges no-dev -p <crate> --color never, buffers the complete graph, requires a successful Cargo exit before inspection, preserves stderr and the failing status, and rejects empty/whitespace-only output. Package-name boundaries keep allowed lookalikes (stateright-helper, proptest-helper) passing. Policy unchanged: temper-verify forbidden only in temper-jit; stateright/proptest forbidden in the jit/server/runtime non-dev graphs.
• scripts/test-dependency-isolation.sh:19 controlled-Cargo regression cases invoking the production guard: allowed graph, each forbidden package in each protected root, verifier allowed outside jit, Cargo failure with preserved stderr/exit per root, empty and whitespace-only output, SIGPIPE-style status141 with partial output, and a large graph with an early forbidden entry followed by10,000 dependencies.
• .github/workflows/ci.yml: the isolation step now runs the tested implementation, with the regression suite immediately before it.

Verification

• Discriminating RED against the extracted original CI block: an injected Cargo exit42 was swallowed and reported OK (FAIL cargo-error-jit: expected exit 42, got 0).
• Corrected suite:19/19 cases pass. A first candidate run that hit a20s tool timeout after18/19 cases is preserved as a failure; the root cause was a quadratic whitespace check in the new test code, fixed at source with workload and assertions unchanged.
• Real supported queries for all three crates exited0 on the pinned toolchain; the real guard prints Dependency isolation: OK; current default-feature host graphs contain no forbidden dependencies.
• bash -n on both scripts and git diff --check pass. A fresh independent source review found no issues.

Limits

• Shell/CI-only change: no dependencies, features or Rust code changed; no workspace/backend tests warranted.
• Real-query evidence covers the pinned toolchain and default-feature host graphs, not every feature/target combination.
• ShellCheck and a YAML parser were unavailable locally; workflow wiring was reviewed as source.
• Pre-existing unsupported queries in scripts/audit-deps.sh and .claude/hooks/check-deps.sh are intentionally out of scope.

Confidence Score: 5/5

The PR appears safe to merge; no actionable issues were found.

Summary

Moves dependency isolation into a tested script. Cargo errors and empty graphs now fail the check instead of reporting success.

• Keeps the existing default-feature, non-dev dependency policy.
• Adds 19 regression cases before the real CI check.
• At the head commit, all 19 cases, Bash syntax checks, and git diff --check passed.
• Real Cargo queries were not rerun during this review.
• gabrik explicitly limits this change to default-feature host graphs; other feature and target combinations remain outside its scope.
• gabrik explicitly leaves the existing unsupported queries in scripts/audit-deps.sh and .claude/hooks/check-deps.sh out of scope.

_{Reviews (1) · Last reviewed commit: "fix(ci): fail dependency isolation on ca..." · Reviewed by Greptile}