fix(ci): keep the push suite inside the runner's memory and time budget

Assisted-by: GLM 5.3 Flash

asm/goobj_resolve_test.go

@@ -45,6 +45,9 @@ func TestReadRuntimeSymbols(t *testing.T) {
 // TestResolveExternalSymbols verifies end-to-end resolution of external
 // symbol references.
 func TestResolveExternalSymbols(t *testing.T) {
+	if testing.Short() {
+		t.Skip("resolves through a live go list -export: skipped in -short mode")
+	}
 	if _, err := exec.LookPath("go"); err != nil {
 		t.Skip("go toolchain not available")
 	}

asm/goobj_test.go

@@ -564,6 +564,14 @@ func parseBuildLog(t *testing.T, log []byte, asmFile string) buildLogSteps {
 func substituteAndRelink(t *testing.T, goBin, dir string, st buildLogSteps, outBin string, gasmObj []byte, extraEnv ...string) {
 	t.Helper()
 
+	// The deliberate-run boundary: this path drives a real `go build` and
+	// cmd/link per invocation, minutes-scale work on the small single-core
+	// CI runner.  Under -short (the push pipeline's mode) it skips; the
+	// local test gate and the dispatched workflows run it in full.
+	if testing.Short() {
+		t.Skip("end-to-end go build and link: skipped in -short mode")
+	}
+
 	// Extract the archive, overwrite the assembler's member with the gasm
 	// object and repack (go tool pack has no replace-in-place).
 	membersDir := filepath.Join(dir, "members")
@@ -655,6 +663,9 @@ func substituteAndRelink(t *testing.T, goBin, dir string, st buildLogSteps, outB
 // failed.  The binary is not run: morestack returns to the call site's
 // stack check, which a hand-written caller has none of.
 func TestGOObjectExternalPackageLink(t *testing.T) {
+	if testing.Short() {
+		t.Skip("end-to-end go build and link: skipped in -short mode")
+	}
 	goBin, err := exec.LookPath("go")
 	if err != nil {
 		t.Skip("no Go toolchain available")

asm/kernels_differential_test.go

@@ -23,9 +23,18 @@ import (
 // bytes must agree with the relocation sites masked on both sides.
 
 // toolAsmObject assembles path with the installed toolchain's assembler for
-// goarch ("" = the host) and returns the object bytes.
+// goarch ("" = the host) and returns the object bytes.  Every live-oracle
+// comparison funnels through here, so this is also where the deliberate-run
+// boundary sits: under -short (the push pipeline's mode) the comparisons
+// skip, because each spawns a go tool asm subprocess and the small single-
+// core runner pays seconds per spawn.  The encodings stay pinned by the
+// golden-byte tests in every mode; the live oracle runs in the local test
+// gate and the dispatched workflows.
 func toolAsmObject(t *testing.T, path, goarch string) []byte {
 	t.Helper()
+	if testing.Short() {
+		t.Skip("live go tool asm oracle: skipped in -short mode")
+	}
 	goBin, err := exec.LookPath("go")
 	if err != nil {
 		t.Skip("no Go toolchain available")