Fold ci_regen into the ci job as an enforcing step (free a runner slot)

[gunbai-bot]

What

Fold the ci_regen job into the ci job as an enforcing step (operator: "move ci regen check into ci for now so we don't have another job" + "if its truly red it should block merge"). One fewer runner-slot-consuming job; the self-host fixed-point (regen-verify + staleness) now gates merge as a step of the required ci job instead of a separate non-required job.

Structural change (dag/gunbc/ci_workflow.dag)

• ci_regen_floor_step() appended to ci_job()'s step list (enforcing — continue_on_error: none).
• ci_regen_job() deleted; jobs list → concat([ci_job()], ci_deploy_jobs()).
• Job backstop gains one gunbc_ci_floor_step_timeout_minutes term for the folded regen step (still the exact step-sum + prelude).
• Regen step name / gunbc_ci_regen_spec.notice_title updated from "non-required" → "required; folded into ci job".

The regen spec and its gate projection surface (GithubActionsCiRegenJob, gunbc_ci_regen_floor_gates, gunbc_ci_regen_floor_batches) are unchanged — the fold only moves where the regen runs, not the gates it carries. .github/workflows/ci.yml regenerated via main_wet (71 lines removed; single ci job).

Materialization consequence — the fold dissolves real duplication (§2)

Before: CI built the release binary on two independent jobs (ci_job + ci_regen_job), a genuine cross-job duplication that sccache discharged. Folding to one job removes the duplication entirely, so the live release build is now a single demand → AcceptedSingleRecompute (ladder state 5: a lone undeclared demand needs no provider, so it holds with or without sccache).

Enrolled live witnesses (dag/test/claim/ci_materialization_witness_test.dag) redesigned for the single-build reality:

• ci_single_release_build_is_accepted_single_recompute — demand==1, single-recompute arm, discharged_by_sccache==0.
• ci_ladder_holds_without_sccache_single_build — holds without provider, refused_without_provider==0.
• Recomputed count pins: uses-steps 3, run-step-natures 11.
• Added a targeted ci_release_build_single_recompute_count() to the gate.

Red control migrated, not lost (§5)

Removing the live duplication removes the live "duplication → refusal" red control. It moves to the synthetic placement_grain_witness_test.dag (two independently-building jobs → AuthoredDuplication/RefusedNoProvider), which I enrolled in commit_gate_roster so the reintroduction guard actually gates. The stale ci_regen_job fixture was renamed second_building_job (that job no longer exists). The live witness's demand==1 / discharged==0 pins also red on reintroduction.

Drive-by

witness_steps_sequence_elements_are_yaml_values pinned the first job's step count at 8 — stale since #6243 (ci_job has had 13+ steps for many PRs; the witness is not CI-enrolled, so its redness never gated). Corrected to the true post-fold count 14.

Verification (green-by-execution, local arm64, post-merge-with-main)

Merged origin/main (4 PRs since branch, incl. #6444 CI-floor migration, #6460 interpreter cache) — auto-resolved, no conflicts. Rebuilt binaries locally (arm64; the remote ctrl-build uploads 0 artifacts). main_wet regen clean, no ci.yml drift. All affected witness files PASS: ci_materialization (8), placement_grain (5), ci_spec / gate-coproduct-completeness, commit_workflow (2), ci_yaml_serializer keystone, ci_floor_plan (9, incl. #6444's runner-migration), floor_materialization (3).

Pre-existing, non-enrolled ci_deploy_witnesses null-RED (empty deploy_stages) is untouched and orthogonal.

🤖 Generated with Claude Code