fix(ci): predict release impact and align Nightly build contracts

[wgqqqqq]

Objective

Give ordinary PRs high confidence that they will not break release builds, without paying the cost of all seven artifact builds on every merge. Scheduled and manually dispatched Nightly runs remain the final full-build safety net.

Validation strategy

Change type	PR validation
Documentation and images only	Skip expensive builds
Web UI / Mobile Web	Production frontend build and release preflights
Ordinary Rust / application code	Rust and CLI checks on all three platforms, plus release preflights
Installer / Windows packaging	Add the real Windows package producer
macOS signing / packaging paths	Add the real macOS arm64 and x64 package producers
Linux Desktop / AppImage paths	Add the real Linux arm64 and x64 package producers
CLI / Relay release paths	Add the real Linux arm64 and x64 binary producers
Root Cargo dependencies, lockfile, shared release scripts, or workflows	Fail closed: all seven producers plus DSH

Impact-selected PR package checks reuse the Nightly artifact workflow with artifact uploads and cache writes disabled. Scheduled and manual Nightly runs explicitly execute all five Desktop/Installer producers and both Linux CLI/Relay producers.

Root causes and fixes

Root cause	Impact	Fix
CI and Nightly duplicated release steps	CI could pass while the real build contract drifted	Extract a reusable artifact workflow and invoke the same build path from CI according to risk
CI checked source compilation but not projected versions, lockfiles, Installer i18n, or Tauri package alignment	Metadata and generated-file failures appeared only in Nightly	Add low-cost release preflights to frontend CI and run real package producers for high-risk paths
PR merge refs and main/explore branches could share or write caches	Test branches could contaminate trusted builds	Make PR/fork caches restore-only, include the base branch in Rust keys, and disable automatic setup-node/pnpm and Bun cache writes
The reusable workflow received the retention input as a string	Artifact upload rejected the parameter type	Coerce the value explicitly at the workflow boundary
Nightly publishing permissions were coupled to artifact builds and the repository owner was hard-coded	Fork validation was difficult and the permission surface was too broad	Separate unprivileged builds from privileged publishing and restrict publishing using the current repository owner
The macOS process test depended on shell scheduling	SIGTERM could be misclassified and escalated to SIGKILL	Use a deterministic fork/signal-handshake test process; reproductions: run 32749355909, run 32563206258, run 32288772415
The embedded relay rebound immediately after releasing a port	macOS intermittently returned Address already in use	Add a bounded retry only for same-port bind conflicts; example: run 32467573929
FSEvents used a fixed sleep and ConPTY tests shared native state	Intermittent macOS and Windows timing failures	Use semantic readiness for FSEvents and serialize native ConPTY test cases
Dispatch leases relied only on file-handle destruction	macOS could still report the OS lock as held immediately after drop	Explicitly unlock WorkspaceLock and DispatchLease during destruction; example: run 32356148701

Validation

• pnpm run check:github-config: 20 passed, 1 skipped locally because PowerShell is unavailable; the Windows runner executes that truth table
• Build-impact classifier: 5/5
• pnpm run check:repo-hygiene
• Root and Installer locked metadata, Installer i18n, Tauri package alignment, generated APIs, Web UI, Mobile Web, extension host, and a fake Nightly version projection
• macOS CLI signal race: 20/20; embedded relay port lifecycle: 20/20; FSEvents: 180/180 across 20 rounds; dispatch lease reacquisition: 200/200
• Fork predictive CI: run 32732505811, with all ordinary checks and all 7 producers successful
• Fork incremental lock-fix CI: run 32755296785, with three-platform Rust/CLI, Frontend, and the aggregate gate successful; the ordinary Rust change correctly did not select real package producers
• Fork full workflow-stack build_only Nightly: run 32738729926, with all five Desktop/Installer producers and both Linux binary producers successful; privileged publishing was skipped as intended
• Upstream PR CI: run 32758983607, with three-platform Rust/CLI, Frontend, DSH, all 7 impact-selected producers, and the aggregate gate successful
• Full Nightly artifacts: 7/7, totaling 2,356,508,054 bytes; macos-x64 256,246,516, macos-arm64 243,170,102, windows-x64 105,527,345, linux-x64 838,784,181, linux-arm64 806,407,649, Linux binaries x64 55,103,591, and arm64 51,268,670
• Fork cache audit: the final formal Nightly created no writable build caches; five temporary Bun caches created by earlier validation runs before the final no-cache fix were deleted by exact ID, and the target refs are empty

Scope

Product behavior contracts are unchanged. Outside workflows, release contracts, and test stability, the only runtime change is explicit release of an existing Detached Dispatch file lock. The Detached Dispatch lock lifecycle received focused local regression coverage but no cross-host validation. Remote Workspace, Remote Control, and Peer Device paths are unchanged.