Migrate generated ci.yml to a thin-shim calling a .dag binary via emit(intent,Bash) [gap C]

[gunbai-bot]

Auto-opened by session-dashboard for session calm-carp-756.
Pushing to session/calm-carp-756 advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[gunbai-bot]

CI triage — the failing ci job is pre-existing main breakage, not introduced by this PR.

The ci job fails on two tree-wide discovery witnesses: doc_graph_has_no_orphan_docs and medium_structure_clean_tree_holds. Both return Bool(false) on a clean origin/main checkout as well, and the medium-structure leak count is identical (1) on origin/main and on this branch — so tier (ii) adds zero new leaks/orphans. main's own CI has been failing on every recent push (e039892, e789f34, etc.), confirming a systemic main red from the recent merge wave.

This PR's own surface is green by execution: rust_tests passes, the generated-artifact drift gate passes, the build-artifact verification teeth pass, and the updated witnesses (build_artifact_verification_holds, ci_spec_witnesses) are true. I'm not bundling the orphan-doc / medium-leak fix here — it's unrelated tree-wide debt owned by the main-lockdown lane, and absorbing it into a narrowly-scoped migration would be scope creep. Surfacing to the lane manager for routing.

— sent from calm-carp-756

[gunbai-bot]

CI triage: the failing ci job is a self-hosted runner infrastructure crash, not a gate/witness verdict. The check-run annotation is identical on this PR and on main HEAD fdcdceb (#5825, merged after the #5821 floor fix): "The self-hosted runner lost communication with the server ... terminates the runner process, starves it of resources." The gh log archive contains no floor-step output because the runner died mid-step. Evidence it is pre-existing fleet infra (not this change): main's own ci job fails the same way in ~21min, and this PR's rust_tests job is green. All tier-ii witnesses (build_artifact_verification_holds, ci_spec_witnesses) and the generated-artifact drift gate verify green locally. No rework — routing the runner-OOM to the fleet/lockdown owner. — sent from calm-carp-756

[gunbai-bot]

Thanks for the APPROVE. On the one noted smell — artifact_shell_path / the fold(... concat ...) in ci_spec.dag:139-152 hand-rolling bash assembly instead of routing through tools.build_step's emit surface: confirmed valid, and intentionally deferred, not an oversight. This PR is scoped to tier (ii) — move the verification logic into the floor binary (claim_executor --verify-build-artifacts) as a self-contained, no-cross-tree-import step. Routing the call-site assembly through emit(intent, Bash) is exactly tier (iii) (the general orchestration-intent→bash fold), which is held pending that fold + the cross-tree decision. ci_spec.dag deliberately stays on the §0 medium_structure_exception_roster (medium_structure_containment.dag:136) for this window, so the transitional inline assembly is sanctioned/contained rather than a leak — exactly the 'transitional shim toward emit(intent,Bash)' you flagged. It dissolves next pass with tier (iii). No fix commit for this PR. — sent from calm-carp-756