ci: harden PR gates and sequence recovery before Phase D (#113)

[IvanChernyshov]

Implements the accepted infrastructure/process contract in #113. Targets dev;
leave this PR and the issue open for final exact-head CI and independent review.

1. Executable CI/gate behavior and regression proof

Normal CI groups successive heads by workflow and PR identity and cancels
superseded PR runs. Non-PR groups use run ID plus attempt, avoiding both active
cancellation and pending displacement of independent evidence. Reusable Wheels
has no concurrency group, so it cannot cancel the caller.

All seven matrices use github.event_name == 'pull_request' for fail-fast.
Reusable Wheels receives caller context directly; no input, global kill job,
serial preflight or Actions-write permission was added. Existing Python/platform
members, qualification commands, positive/refusal routes, artifacts, sdist
round-trip and distribution/aggregate validators are preserved.

--check-gate independently requires literal successful classification, typed
outputs, valid nonempty requirements and one of the exact current route-profile
unions. It rejects malformed/missing input, duplicate JSON object keys or
requirements, non-string/unknown/nonselectable IDs, incomplete profiles and every
non-success required conclusion. classify is validated independently.
Nonrequired skipped/cancelled jobs remain valid; CI gate retains always()
and direct needs on all ten selectable families plus classification.

Extended the existing classifier test file with CLI regressions and semantic
YAML policy tests. Baseline reproduction: 44 tests failed / 69 passed; changed
candidate: 113 passed. PyYAML is only a test/dev/all extra and is explicitly
installed in controlled test environments before their suites; no runtime
dependency was added. Parsed workflows equal the baseline after normalizing
only concurrency, fail-fast and this test dependency installation.

2. Agent/human workflow and branch semantics

AGENTS.md now distinguishes focused iteration from broad pre-publication
verification, requires honest reporting of unavailable native coverage,
encourages safe cancellation of an observed obsolete PR run needing a new head,
and defaults to CI-pending handoff rather than passive polling.

The human workflow defines contributor/implementer/reviewer/maintainer roles,
separates self-check/handoff from independent acceptance, and gives ordinary
contributors scope-appropriate verification guidance. Release-scoped PRs target
dev; approved named candidates promote by PR to stable/release main, whose
canonical commit is identified/qualified before #48 tag/publication. Emergency
stable fixes require an explicitly approved PR to main, immediate
reconciliation PR into dev, and updates/rebases of open dev PRs after that
reconciliation. No ruleset change or branch-protection bypass.

3. ADR/plan sequencing and WP11 reconciliation

Narrow dated amendment to ADR 0017; active plan revision 1.9:

Phase C refinement gate → optional accepted narrow refinement → Checkpoint C →
whole-code comprehension/reconciliation, separate audit, explicit dispositions
and individually verified accepted remediation → WP12 → WP13 → bounded
recovery-baseline delta review (full renewed review if maintainer escalates) →
documentation overhaul → #48.

This lets WP12 qualify public workflows after accepted recovery. No second full
reread/audit is mandatory by default. Recovery uses one JIT umbrella; remediation
children appear only for accepted findings, with a separate remediation umbrella
only when coordination is needed. No recovery issue or later gate was started.

Reconciled workflow, AGENTS, CONTRIBUTING, architecture, roadmap, plan/development
indexes, living intake and API inventory. Historical revision rows and the dated
Phase-C review are preserved, with an explicit current sequencing note. WP11 is
recorded as #111 completed / PR #112 accepted and merged, reviewed head
194500338b5a782420fb438a967c0fe9a7f721d4, CI 37310641186, merge
6eb56a02d422e33d17fb84c57145b208e5d1bab7; lifecycle classifications remain
Provisional final state / Experimental advanced path. Changelog groups process
changes. Scientific/native/public-API behavior is unchanged.

Post-merge maintainer action: add one unchecked abstract gate to #47 between
Checkpoint C and Phase D: Pre-Phase-D gate — whole-code comprehension and audit.
Update its dependency outline and close/update the #113 process-hardening entry
only after accepted integration. Leave Phase-C refinement, Checkpoint C, WP12 and
WP13 pending. Create the recovery umbrella when that gate becomes actionable,
not during this PR; #47 has not been prematurely changed here.

4. Manifest, local validation and final evidence

Base dev: 6eb56a02d422e33d17fb84c57145b208e5d1bab7.
Base tree: 2e3b762b51d3bdb6b7331f033d54d2bd3635480d.
Candidate: f207c701b4d651d6827a76764bcd468cc47213d5.
Candidate tree: e59b9cb9c79aa8eb83fef53084b74e3db0a6eb40.
The connected GitHub publication commit has the exact locally reviewed tree;
only commit metadata differs from the local pre-publication commit.
Branch: infra/113-ci-process-hardening. Complete diff: 19 files,
808 insertions / 235 deletions.

Explicit measure/update/check ran after every measured batch and final fix;
final update was unchanged and check current. Canonical manifest SHA-256:
e2591e36bc5e02db099beab07e2c497cd79150b156e0b22e44d987edb58b419b.
Aggregate source: ef68168f89217589d8d86be192b7d0d4c9b9fb3464ebadc5c404cb4c6786f19d.
Consumer: 472ff4e1f11d4673cda7a08f2663e842a51d78897bd20dc7b63a594fcbda940f.
Schema: e9b5ddbea1dc313d64043bae5fa0992dffe3f18f4570b9ada4ef4fe6f6ff9d0d.
404 measured files / 81 consumers. Only five measured inputs changed:
CI/Wheels workflows, pyproject, classifier tool and its tests. Consumer/schema
identities and native source remain unchanged. No automatic refresh or closure
widening was introduced.

Local Python 3.12.14, GNU 13.3, PyYAML 6.0.3:

Command/check	Result
pytest -q tests/tooling/test_ci_classify_changes.py	113 passed
Classifier + release-tool selection	317 passed
Source-manifest/build/route/generated-tool selection	141 passed
pytest -q tests/tooling against fresh unissued direct wheel	942 passed, 7 skipped
flake8 src tests tools benchmarks examples	Passed
python tools/export_notebooks.py --check	Passed
python tools/gen_readme.py --check	Passed
mkdocs build --strict	Passed
Explicit manifest measure/update/check	Passed/current
Actual base-to-head classification	FULL, eight required families below

Selections overlap and are not summed. Tooling uses a fresh ordinary unissued
wheel with a byte-identical candidate manifest, not an older donor. Local native
qualification/full-suite coverage is not claimed: source-only tooling/full
collection first lacked native modules (one/eleven collection errors). Controlled
full qualification was attempted; after installing missing CMake/Ninja and
selecting available CXX=g++-13, it refused changed evidence at retained
production-commands/details/113cc103a971475b88eb5f4b29cbe218/driver-loader.403.
No admission, provenance or test-filter bypass. The historical attached WP8 kit
was not used for candidate evidence.

Complete actual diff requires build-dist, docs-and-notebooks, lint-sync,
native-avx-fma, native-sanitizers, test-linux-qualified,
test-other-platforms, and wheels, then aggregate CI gate.
test-linux-runtime/test-linux-compat are correctly nonrequired for this FULL
diff. Native/build/route/record and final 20-wheel + sdist evidence must come
from the required final-head CI; no local substitute is asserted.

A fresh read-only internal pre-publication reviewer found no outstanding
Critical/Important/Minor findings. That is not final independent acceptance.
No obsolete PR run was cancelled; this is the first published candidate.
CI snapshot at 2026-10-05T20:38:23.636Z: run 37370845751, attempt 1
for f207c701b4d651d6827a76764bcd468cc47213d5 is queued, conclusion pending.
Only classify is currently queued (job 111967287873); selected families
and aggregate have no conclusions yet. No artifacts are available at this snapshot.
Required native/build/route/qualification records and final 20-wheel + sdist
validation remain pending on this exact run/head. This is an implementation
handoff with CI pending; no prolonged polling or acceptance claim.
One final independent reviewer must assess the complete PR and exact-head
evidence before maintainer integration. Earlier-head evidence cannot qualify a
later candidate. No scope/policy deviations; follow-up is final CI/review and
post-merge tracking only.