ci: shrink the push pipeline to the affordable gate set

Assisted-by: GLM 5.3 Flash

.gitea/workflows/test.yml

@@ -6,6 +6,11 @@
 # everything runs in one job. Extra jobs would duplicate the checkout, the Go setup and
 # the dependency download three times without buying any parallelism.
 #
+# The budget is part of the contract: a push run is fast and light, about two minutes,
+# and nothing that cannot run natively on the runner belongs here. The FreeBSD compile
+# gates live in freebsd.yml behind workflow_dispatch for that reason; the GOOBJ link
+# parity campaign is an opt-in local verification (just link-parity).
+#
 # Every step is one command, so the step that fails is the gate that failed, and no shell
 # option has to be trusted for the run to stop. The scripted steps are Perl, not shell and
 # not Python: Perl behaves the same on both runner images, there is no bashism to trip over
@@ -56,28 +61,6 @@ jobs:
       - name: Build
         run: go build ./...
 
-      - name: FreeBSD build (amd64)
-        # The debugger's ptrace surface and the JIT substrate are the two
-        # FreeBSD-portable layers the tree carries; the forge has no FreeBSD
-        # runner, so a push can only compile-gate them. Running the ptrace
-        # suite needs real FreeBSD hardware.
-        env:
-          GOOS: freebsd
-          GOARCH: amd64
-        run: go build ./...
-
-      - name: FreeBSD build (arm64)
-        env:
-          GOOS: freebsd
-          GOARCH: arm64
-        run: go build ./...
-
-      - name: FreeBSD build (riscv64)
-        env:
-          GOOS: freebsd
-          GOARCH: riscv64
-        run: go build ./...
-
       - name: Format
         run: |
           perl -e '
@@ -104,7 +87,11 @@ jobs:
         # command, so the floor is the same number everywhere. ./verify/... carries the
         # live oracle-parity comparison against `go tool asm` (the TestGroundTruth
         # suites); the runner's Go setup provides both the tool and GOROOT.
-        run: go test -count=1 -timeout 10m -coverprofile=coverage.out ./arch/... ./asm/... ./ast/... ./disasm/... ./format/... ./lexer/... ./lint/... ./lsp/... ./parser/... ./token/... ./verify/...
+        # -short skips the deliberate-run categories inside the suites (the live
+        # ptrace sessions above all): they need the machine to themselves and a
+        # starved single-core runner turns each into a timeout the budget cannot
+        # carry. The local `just test` gate runs everything, in full.
+        run: go test -short -count=1 -timeout 10m -coverprofile=coverage.out ./arch/... ./asm/... ./ast/... ./disasm/... ./format/... ./lexer/... ./lint/... ./lsp/... ./parser/... ./token/... ./verify/...
 
       - name: Tests outside the coverage set
         # The CLI and the debugger sit outside `packages` because a thin main and a
@@ -112,12 +99,12 @@ jobs:
         # shipped surfaces: the command exit codes, the manual pages against the
         # binary's own help, and the debugger's architecture-neutral units.  They run
         # here so the floor stays a product measure and nothing is left untested.
-        run: go test -count=1 -timeout 10m ./cmd/... ./debug/...
-
-      - name: Oracle parity
-        # Re-run the live go-tool-asm comparison as its own step so that a parity
-        # regression names the gate that failed instead of hiding inside the suite.
-        run: go test -count=1 -timeout 10m -run 'TestGroundTruth' ./verify/...
+        # -short skips the debugger's live ptrace sessions, the deliberate-run
+        # category the runner cannot starve-proof. The live go-tool-asm oracle
+        # comparison (TestGroundTruth in ./verify/...) runs inside the coverage
+        # sweep above; it is not re-run as its own step, because every second on
+        # this box is budget.
+        run: go test -short -count=1 -timeout 10m ./cmd/... ./debug/...
 
       - name: Coverage floor
         run: |