ci: native-live and the ubuntu Debug leg as pool-only required PR checks under the CI canon

[luisleo526]

Summary

Applies the frozen CI canon (ci-labels.md; written against SHA-256 ac875205d8bdae2d7e0c23aca438118a0e9da2efb297de4e6b2cd80e7416f5b3, re-checked at 2026-10-21 03:28 against r9, SHA-256 prefix 74c8335c, which only adds the release-chain exception paragraph: the authz job text is unchanged, and the authz job in ci.yml and in native-live.yml has the same md5 as the r9 canon job, fecc1a83d04d56e9aa3226b9913e5736) to engine CI, so every CI job runs on our own machines (owner rulings CI-HOSTED = B and REL-HOSTED = B; only macOS stays on GitHub) behind the canon authz job:

• ci.yml and the reusable native-live.yml carry the canon authz job byte for byte; every other job needs: authz; the PR branch filter and the hosted-runner fallbacks are removed; preflight and the Linux builds use the heavy pool label ["self-hosted","pf-ci","pf-ci-x64-16"], the rest use ["self-hosted","pf-ci","pf-ci-x64"]; the existing macos-26 exception stays.
• Both always-running aggregates (build-gate, native-live-gate) start with the canon refusal step for a non-successful authz; the caller keeps only the classified docs-only skip exception. Every inline job with a status function (always, cancelled, failure, success) starts with the canon refusal step before any checkout.
• native-live and the Ubuntu Debug leg run as canon pull_request checks.
• scripts/ci_preflight.py and scripts/test_ci_preflight.py pin the resolved arrays, the authz script and dependencies, and the refusal steps, with file-backed mutations; .github/actionlint.yaml declares the pool labels (merged with main's superset after ci: release jobs run on pf-ci-release (owner: CI on our machines) #461).
• docs/ci.md replaces the runner/fallback and classification policy with the October 20 rulings (the earlier hosted-credential paragraphs are superseded and quoted in the docs commit message), restores the rules the preflight still enforces with their exact enforcing lines, and states that ci: release jobs run on pf-ci-release (owner: CI on our machines) #461 has merged: the old hosted pins for the engine's release and promote jobs are gone, those jobs are pinned to pf-ci-release, and docs build stays hosted (cited with the real lines of the resolved scripts/ci_preflight.py).

Merge with #461

Engine main moved to 03b2406dd (PR #461, release and promote jobs on pf-ci-release) while this PR was open. This branch took it with one merge commit (b3c7d5e07): scripts/ci_preflight.py (3 conflict hunks), scripts/test_ci_preflight.py (2), docs/ci.md (4) and .github/actionlint.yaml (main's superset taken) conflicted; both intents are kept. The canon pins, authz and refusal-step checks, and the canon text are untouched; #461's RELEASE_RUNNER, RELEASE_JOB_RUNNERS, event checks and tests come in; HOSTED_JOB_RUNNERS keeps only docs build; the two tests that asserted the old hosted promote/release routes are replaced by #461's pinned-route tests. The resolution was made by a Codex lane and read hunk by hunk against both parents by the supervisor.

Verification record

• Preflight (CLOUD) on the merged head b3c7d5e07 (tree 0bac42b6, clean, corpus checked out): job rj-20261020t182540-48397d, ci_preflight: passed (exit 0, 54 stages, 0 advisory), 503 s, including doc-reverts and the preflight's own test stage. (Earlier head 4bd57b7ca: rj-20261020t165627-894faa, 53 stages, passed.)
• TypeSafe diff guard on git diff gh/main HEAD of the merged head (122 KB, brief 12,520 chars, not truncated, 3 parts): PASS literal_hack 0.13, scope_creep 1.73, debug_left 0.18, does_what_brief_asks 0.55. Raw: runs/core-org-r33/guardcanon4/guard.raw (the pre-merge head's guard: guardcanon3/guard.raw, PASS).
• Gating read (CORE-TOP, Opus) of the pre-merge head: ACCEPT, docs fixes applied. One read note (P2) accepted: the status-function jobs start with a checkout step in the canon order.

Policy checker (ci-policy-check.py, --not-required preflight,build,sanitizers,kernel-only,native-live,corpus-parity-subset)

head	checker	findings	R1	R2	R3	R5	R6
4bd57b7ca	15e7f2ba (before #938)	18	1	2	3	4	8
4bd57b7ca	2de765f2 (after #938)	14	1	2	3	0	8
b3c7d5e07 (this head, after #461)	2de765f2	11	1	2	3	0	5
b3c7d5e07 (this head), canon r9	fd795257	11 (same lines)	1	2	3	0	5

The four R5 findings were the canon's own aggregate shape in ci.yml (native-live step 1, corpus-parity-subset step 1, build-gate step 2) and native-live.yml (native-live-gate step 2). L6 ruled (2026-10-21 00:30) that the frozen canon wins and that the checker was wrong; laneboss's fix (#938) removed exactly those four lines. The canon text is unchanged. The three R6 findings that disappeared with the merge were the engine's release.yml jobs (release, notify-hub) and promote-baseline.yml promote, now on pf-ci-release. Raw outputs: runs/core-org-r33/guardcanon3/policy-before-0109.txt, policy-after-0158.txt, guardcanon4/policy-merged.txt.

The 11 remaining findings are on files this PR does not touch, plus one the checker cannot resolve:

• corpus-parity.yml (R2 no authz job; R3 two jobs do not need it; R6 hosted fallback), docs.yml (R2, R3, R6: Cloudflare-secret build), promote-baseline.yml (R1 pull_request_target, an L6-named exception) and release.yml prebuilt (R6: its matrix mixes the pool label with hosted ARM/macOS legs): pre-existing, carded as their own PR (CI-PREEXISTING-R2R3R6).
• ci.yml job build (R6): runs-on: ${{ fromJSON(matrix.runner) }} where the matrix holds the two literal arrays ["self-hosted","pf-ci","pf-ci-x64-16"] and ["macos-26"]; both are canonical, the checker does not resolve matrix expressions.

Notes

• Nothing from this repository ran on the authoring machine; the preflight above is the run. The PR's own CI on the pool is the first run of the authz job and the refusal steps in the real pull_request path.
• Rulesets for the repositories are prepared separately and are applied after the PRs merge.

🤖 Generated with Claude Code