ci: fence the test recipes and rebuild the pipelines around the gate set

Assisted-by: DeepSeek V4.1 Flash

justfile

@@ -11,19 +11,26 @@ package := "./cmd/interpres-decode"
 # failure, not an empty run.
 packages := "./..."
 
+# The memory fence for the test recipes: a cgroup ceiling with swap off, so a
+# runaway run dies as a failed run and never eats the machine. 4G is the
+# default; raise it only with a reason recorded here.
+memlimit := "4G"
+
 bindir := env_var_or_default("BINDIR", env_var("HOME") / ".local" / "bin")
 
 default:
     @just --list
 
-# Compile. Zero errors, zero warnings.
+# Compile. Zero errors, zero warnings; -trimpath and -buildvcs make the binary place-independent and version-stamped.
 build:
-    CGO_ENABLED=0 go build -ldflags "-s -w" -o bin/{{binary}} {{package}}
+    CGO_ENABLED=0 go build -trimpath -buildvcs=true -ldflags "-s -w" -o bin/{{binary}} {{package}}
 
-# The test gate: the suite, no cache, the coverage floor.
+# The test gate: the suite, no cache, the coverage floor, under the memory fence.
 test:
     #!/usr/bin/env perl
-    system(q{go}, q{test}, q{-count=1}, q{-timeout}, q{30m},
+    my @fence = (q{systemd-run}, q{--user}, q{--scope},
+                 q{-p}, q{MemoryMax={{memlimit}}}, q{-p}, q{MemorySwapMax=0});
+    system(@fence, q{go}, q{test}, q{-count=1}, q{-timeout}, q{0},
       q{-coverprofile}, q{coverage.out}, qw({{packages}})) == 0
       or die qq{the test suite failed\n};
     open(my $c, q{-|}, q{go}, q{tool}, q{cover}, q{-func=coverage.out}) or die qq{cover: $!};
@@ -34,21 +41,21 @@ test:
     printf qq{Total coverage: %s%%\n}, $total;
     exit($total < 80 ? 1 : 0);
 
-# The same suite under the race detector. The expensive one.
+# The same suite under the race detector. The expensive one, still fenced.
 race:
-    go test -race -count=1 -timeout 30m {{packages}}
+    systemd-run --user --scope -p MemoryMax={{memlimit}} -p MemorySwapMax=0 go test -race -count=1 -timeout 0 {{packages}}
 
 # Fast scoped run for iterating. This is the one that runs after every edit.
 unit pkgs=packages run=".*":
-    go test {{pkgs}} -run '{{run}}'
+    systemd-run --user --scope -p MemoryMax={{memlimit}} -p MemorySwapMax=0 go test -timeout 0 {{pkgs}} -run '{{run}}'
 
 # Time-boxed fuzz of one target in one package. The package is required; never a gate.
 fuzz target pkg fuzztime="60s":
-    go test -run '^$' -fuzz '{{target}}' -fuzztime={{fuzztime}} {{pkg}}
+    systemd-run --user --scope -p MemoryMax={{memlimit}} -p MemorySwapMax=0 go test -run '^$' -timeout 0 -fuzz '{{target}}' -fuzztime={{fuzztime}} {{pkg}}
 
-# Benchmarks. On an idle machine only.
+# Benchmarks. On an idle machine only, deliberately unfenced: a ceiling would distort the measurement.
 bench pkgs=packages:
-    go test -run '^$' -bench=. -benchmem -count=5 {{pkgs}}
+    go test -run '^$' -timeout 0 -bench=. -benchmem -count=5 {{pkgs}}
 
 # Format in place.
 fmt: