ci: run the affordable gate set on push and publish at the tag

Assisted-by: DeepSeek V4.1 Flash

.gitea/workflows/test.yml

@@ -1,22 +1,20 @@
 # Test, Go. Push and pull request to development. Never on main.
 #
-# The gates are the ones the justfile's `gates` recipe runs, minus race: the shared
-# runner box cannot afford the race detector on every push, so it lives in race.yml.
-# The box is one core and 2 GB beside Gitea, so parallelism is bounded on purpose and
-# everything runs in one job. Extra jobs would duplicate the checkout, the Go setup and
-# the dependency download three times without buying any parallelism.
+# The push path owns a two-minute budget end to end, so it carries exactly the gates
+# that fit it: the format check, go vet, the suite's short layer and the coverage
+# floor. There is no build step (go test compiles what it runs) and the modernisation
+# gate (`go fix -diff`) belongs to the suite workflow, which is dispatched by hand.
+# Nothing is installed: the fedora job image carries git, perl and node (verified on
+# the runner, 2026-10-04), and no pipeline ever installs gcc or runs the race detector.
 #
-# The budget is part of the contract: a push run is fast and light, about two minutes,
-# and nothing that cannot run natively on the runner belongs here. The FreeBSD compile
-# gates live in freebsd.yml behind workflow_dispatch for that reason; the GOOBJ link
-# parity campaign is an opt-in local verification (just link-parity).
+# The live ptrace sessions and the other deliberate-run categories skip under
+# testing.Short: they need the machine to themselves and belong to the suite workflow
+# and to the local `just test`, never to every push.
 #
-# Every step is one command, so the step that fails is the gate that failed, and no shell
-# option has to be trusted for the run to stop. The scripted steps are Perl, not shell and
-# not Python: Perl behaves the same on both runner images, there is no bashism to trip over
-# on ash, and it is one language instead of two. The Perl uses builtins only, because
-# Fedora packages the Perl modules separately and nothing beyond `perl` itself may be
-# assumed present.
+# Every step is one command, so the step that fails is the gate that failed, and no
+# shell option has to be trusted for the run to stop. The scripted steps are Perl with
+# builtins only: Fedora packages the Perl modules separately, so nothing beyond `perl`
+# itself may be assumed present, and there is no bashism to trip over.
 name: Test
 
 on:
@@ -41,7 +39,6 @@ concurrency:
 jobs:
   test:
     runs-on: fedora
-    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v7
 
@@ -51,15 +48,6 @@ jobs:
           go-version-file: go.mod
           cache: true
 
-      # No Install Perl step: the fedora image carries perl (verified by run
-      # 76: the install degraded into a package upgrade costing ~50 s), and a
-      # dnf on the push path is network work the budget does not need.
-
-      # The steps follow the `gates` order of the justfile contract: build, format,
-      # vet, test. The vet gate is go vet and go fix -diff, two steps here.
-      - name: Build
-        run: go build ./...
-
       - name: Format
         run: |
           perl -e '
@@ -73,37 +61,19 @@ jobs:
       - name: Vet
         run: go vet ./...
 
-      - name: Modernise
-        # Exits non-zero when it has something to rewrite, so it needs no output capture.
-        run: go fix -diff ./...
-
       - name: Tests
-        # The suite must be fast: a push pipeline that cannot finish in a few minutes moves
-        # its heavy part behind a dispatch. The inner timeout matches the job's, so a
-        # hanging test reports its own goroutine dump rather than a silent job kill.
-        # The pattern is `packages` in the project's justfile: the logic packages, since a
-        # thin cmd/ would drag the total under the floor. release.yml runs the same
-        # command, so the floor is the same number everywhere. ./verify/... carries the
-        # live oracle-parity comparison against `go tool asm` (the TestGroundTruth
-        # suites); the runner's Go setup provides both the tool and GOROOT.
-        # -short skips the deliberate-run categories inside the suites (the live
-        # ptrace sessions above all): they need the machine to themselves and a
-        # starved single-core runner turns each into a timeout the budget cannot
-        # carry. The local `just test` gate runs everything, in full.
-        run: go test -short -count=1 -timeout 10m -coverprofile=coverage.out ./arch/... ./asm/... ./ast/... ./disasm/... ./format/... ./lexer/... ./lint/... ./lsp/... ./parser/... ./token/... ./verify/...
+        # The pattern is `packages` in the project's justfile, so the floor is the
+        # same number the local gate reports: the logic packages, since a thin cmd/
+        # and a ptrace-bound debug package would drag the total under it. No timeout
+        # anywhere: `-timeout 0` disables go test's own ten-minute default, because a
+        # run that does not finish is a defect to find and a timeout only hides it.
+        run: go test -short -count=1 -timeout 0 -coverprofile=coverage.out ./arch/... ./asm/... ./ast/... ./disasm/... ./format/... ./lexer/... ./lint/... ./lsp/... ./parser/... ./token/... ./verify/...
 
       - name: Tests outside the coverage set
-        # The CLI and the debugger sit outside `packages` because a thin main and a
-        # ptrace-bound package pull the total under the floor, but their tests guard
-        # shipped surfaces: the command exit codes, the manual pages against the
-        # binary's own help, and the debugger's architecture-neutral units.  They run
-        # here so the floor stays a product measure and nothing is left untested.
-        # -short skips the debugger's live ptrace sessions, the deliberate-run
-        # category the runner cannot starve-proof. The live go-tool-asm oracle
-        # comparison (TestGroundTruth in ./verify/...) runs inside the coverage
-        # sweep above; it is not re-run as its own step, because every second on
-        # this box is budget.
-        run: go test -short -count=1 -timeout 10m ./cmd/... ./debug/...
+        # The CLI's exit codes and manual-page guard and the debugger's
+        # architecture-neutral units, still tested but outside the profile the floor
+        # is computed from. `-short` skips the debugger's live ptrace sessions.
+        run: go test -short -count=1 -timeout 0 ./cmd/... ./debug/...
 
       - name: Coverage floor
         run: |