ci: run the affordable gate set on push and publish at the tag

Assisted-by: DeepSeek V4.1 Flash

docs/DEVELOPMENT.md

@@ -32,12 +32,13 @@ Every recipe in the `justfile`, and what it does.
 | Recipe | What it does |
 |---|---|
 | `default` (bare `just`) | prints the recipe list (`@just --list`) |
-| `just build` | compiles `bin/gasm` with `CGO_ENABLED=0` and stripped symbols; zero errors and zero warnings |
-| `just test` | the test gate: the suite with `-count=1`, the coverage profile and the 80 % floor, then the CLI and debugger tests outside the profile |
-| `just race` | the same suite under the race detector; the expensive one, so it runs once, inside `gates` |
-| `just unit [packages] [run]` | fast, cached, scoped run for iterating: no race and no coverage, so an unchanged package reports instantly |
-| `just fuzz <target> <pkg> [fuzztime]` | time-boxed fuzz of one target; the package is required, because `go test -fuzz` refuses more than one |
-| `just bench [packages]` | benchmarks (`-benchmem -count=5`); on an idle machine only |
+| `just build` | compiles `bin/gasm` with `CGO_ENABLED=0`, `-trimpath` and `-buildvcs=true`, symbols stripped; zero errors and zero warnings |
+| `just test` | the test gate: the full suite with `-count=1` and `-timeout 0` under the 4 GiB memory fence, the coverage profile and the 80 % floor, then the CLI and debugger tests outside the profile |
+| `just race` | the same suite under the race detector, under its own 16 GiB fence; the expensive one, so it runs once, inside `gates` |
+| `just unit [packages] [run]` | fast, cached, scoped run for iterating, under the fence: no race and no coverage, so an unchanged package reports instantly |
+| `just fuzz <target> <pkg> [fuzztime]` | time-boxed fuzz of one target, under the fence; the package is required, because `go test -fuzz` refuses more than one |
+| `just link-parity` | the opt-in cmd/link GOOBJ parity gate; it costs minutes no pipeline can afford |
+| `just bench [packages]` | benchmarks (`-benchmem -count=5`); deliberately unfenced, on an idle machine only |
 | `just fmt` | formats the tree in place with `gofmt` |
 | `just fmt-check` | zero diff; prints nothing when everything is formatted, which is the shape the CI step wants |
 | `just vet` | both static gates: `go vet` and `go fix -diff` |
@@ -54,7 +55,7 @@ Every recipe in the `justfile`, and what it does.
 ### `just test`
 
 ```sh
-go test -count=1 -timeout 10m -coverprofile=coverage.out \
+go test -count=1 -timeout 0 -coverprofile=coverage.out \
     ./arch/... ./asm/... ./ast/... ./disasm/... ./format/... ./lexer/... \
     ./lint/... ./lsp/... ./parser/... ./token/... ./verify/...
 ```
@@ -67,14 +68,18 @@ would drag the coverage total under the floor. Their tests still run, in
 a second invocation without a profile:
 
 ```sh
-go test -count=1 -timeout 10m ./cmd/... ./debug/...
+go test -count=1 -timeout 0 ./cmd/... ./debug/...
 ```
 
 That covers the CLI's exit codes and the guard that compares the manual
-pages with the binary's own help, and the debugger's architecture-neutral
-units. The floor fails if the total is below 80 %.  CI runs the same two
-commands with the same ten-minute bound, so
-the number is the same everywhere.
+pages with the binary's own help, and the debugger's units. The floor
+fails if the total is below 80 %. Both invocations run under a 4 GiB
+cgroup fence with swap off, so a runaway test dies as a failed run
+instead of eating the machine, and no timeout is set: `-timeout 0`
+disables the ten-minute default `go test` would otherwise impose. The
+push pipeline runs the same two commands with `-short`, the suite
+workflow and the local gate run them in full, so the number is the same
+everywhere.
 
 ### `just run`
 
@@ -136,19 +141,30 @@ crash later.
 ## Continuous integration
 
 Workflows live in `.gitea/workflows/` and run on the project's own runners:
-Test on a push or pull request to `development`, race dispatched by hand, and
-the release on a `v*` tag.  They are written by hand rather than through
-`just`, but they enforce the same set of gates minus the race detector, which
-the shared runner cannot afford on a push; a green `just gates` locally is
-therefore the fastest way to a green pipeline.
+
+| Workflow | Trigger | What it does |
+|---|---|---|
+| Test | push or pull request to `development` | the format check, `go vet`, the short layer of the suite with the coverage profile and the 80 % floor, inside the two-minute budget |
+| Suite | dispatched by hand | the complete gate set minus race: the build, the format check, `go vet`, `go fix -diff`, the full suite and the coverage floor |
+| FreeBSD build | dispatched by hand | the three FreeBSD compile gates: `GOOS=freebsd` for amd64, arm64 and riscv64 |
+| Release | a `v*` tag | the matrix build, the version smoke test, and the release with its assets; no gate runs at the tag |
+
+The pipelines are written by hand rather than through `just`, but they enforce
+the same gates: the push path carries the affordable subset and the heavy tests
+skip under `testing.Short`, so the dispatched suite is the moment to prove the
+tree end to end. Race never runs in CI, on a push or a tag: it roughly doubles
+the time and the memory on a shared runner, and the local `just gates` races
+the tree on the machine at the keyboard before the tag is cut.
 
 ## Releases
 
 Releases are cut by merging `development` into `main` and tagging `vX.Y.Z`,
-which triggers the release workflow: it builds the portable Linux targets,
-takes the notes from the matching `CHANGELOG.md` section and uploads the
-assets.  `SECURITY.md` carries the supported-versions table, so that table
-moves with the release; the pipeline refuses a tag the policy does not name.
+which triggers the release workflow: it builds the portable Linux targets
+(amd64, arm64, loong64, riscv64), takes the notes from the matching
+`CHANGELOG.md` section and uploads the assets. No gate runs at the tag, so
+`just gates` must be green on the tree before the tag is cut. `SECURITY.md`
+carries the supported-versions table, naming the version being released; the
+release commit updates it by hand.
 
 The version is never injected. `gasm --version` prints what the
 toolchain recorded in the build information: the tag on a tagged