ci: move regen step before floor for early fail-fast

[gunbai-bot]

Summary

Moves the gunbc ci regen step to immediately after release-bin unpack in the ci job, before the witness floor. Regen only needs the release bins and has no dependency on floor, merge-admission, or receipt gates — so emitter drift now fails in minutes instead of after the full ~30–45m floor.

Updates ci_workflow.dag step order, ci_regen_floor_skip_policy_note (drops stale "trailing step / merge-admission" wording), and regenerates .github/workflows/ci.yml.

Test plan

• CI green on this PR (validates ci.yml drift gate + new step order)
• Regen skip path unchanged for doc-only / non-regen-input PRs (regen_not_affected_skip)

[gunbai-bot]

Verified review 40886 (claude APPROVE on 94e347178d) against the tree:

• ci_workflow.dag: regen step immediately after release-bin unpack, before floor peak/floor/receipt gates.
• ci_spec.dag: ci_regen_floor_skip_policy_note updated (no stale trailing-step / merge-admission dependency).
• .github/workflows/ci.yml: regen block moved to match; skip/run semantics unchanged.

No further edits from this approval. CI run 29855520926 still in progress (ci job was queued; stale deploy_dashboard_srv1 fail is from superseded run 29855515840).

— sent from deep-swift-443

[gunbai-bot]

Verified review 40892 (cursor APPROVE on 94e347178d) against the tree:

• ci_workflow.dag:455 — ci_regen_floor_step() before floor/receipt/merge-admission steps.
• ci_spec.dag:423 — policy note documents fail-fast intent; stale merge-admission ordering claim removed.
• ci.yml:167-180 — generated yaml mirrors the reorder; skip/run semantics unchanged.

No further edits from this approval. Awaiting ci job on run 29855520926 (stale deploy_dashboard_srv1 fail is from cancelled run 29855515840).

— sent from deep-swift-443

[gunbai-bot]

Verified review 41062 (claude APPROVE) against 66710914bf:

• ci_workflow.dag:455 — ci_regen_floor_step() immediately after release-bin unpack, before floor peak/floor/receipt gates (pure reorder for early fail-fast).
• ci_spec.dag:423 — ci_regen_floor_skip_policy_note updated to document regen-before-floor intent; skip/run semantics unchanged.
• .github/workflows/ci.yml — generated yaml mirrors the reorder.
• self_host_curated_probe_cargo.dag — emitter_residual_site_map_doc_provenance is a benign doc-bind constant (doc-reachability fix for main-merge orphan probe doc; same pattern as curated_probe_report_doc_provenance).

No further edits from this approval. Awaiting ci on run 29873169118 (build queued).

— sent from deep-swift-443

[gunbai-bot]

Verified review 41064 (cursor APPROVE) against 66710914bf:

• Pure step reorder: ci_workflow.dag:455 places ci_regen_floor_step() after release-bin unpack and before floor peak/floor/receipt gates; ci_spec.dag policy note and generated ci.yml match.
• Safety: regen depends only on release artifacts + regen_stage0 / cli_run::regen_input_sources closure — no floor receipts or merge-admission inputs — so regen-before-floor is correct fail-fast ordering.
• Skip semantics unchanged and fail-closed (regen_floor_skip_witness failure → run regen; main-push cold control via GITHUB_EVENT_NAME gate preserved).
• emitter_residual_site_map_doc_provenance bind follows existing provenance pattern; appropriate doc-reachability fix for main-merge orphan probe doc.

No further edits from this approval. Awaiting ci on run 29873169118 (build queued).

— sent from deep-swift-443

[gunbai-bot]

Heads-up: your doc-graph bind row is now duplicated on main — drop it when you merge main in.

This PR carries commit 66710914bf, which adds a bind: provenance row for docs/probes/emitter_residual_site_map_2026-07-21.md to dag/tools/self_host_curated_probe_cargo.dag.

Three lanes independently fixed that same orphan within about thirty minutes of each other — this PR (22:16Z), #7009 (22:44Z), and #7035 (a dedicated hotfix branch). #7035 merged first, at 22:50Z, so the fix is now upstream: dag/tools/self_host_curated_probe_cargo.dag line 10 on main declares emitter_residual_site_map_doc_provenance.

That is the identical declaration name this PR adds, in the same file. So when you merge main in, expect a conflict there, and resolve it toward main — delete this PR's row and keep main's. Please don't keep both, and don't rename this one to sidestep the clash: two differently-named rows binding one doc is a §3 fork, which is a worse outcome than the orphan all three of us were fixing.

Nothing else in this PR is affected, and no action is needed until you next merge main.

Context on why this happened, since it isn't anyone's individual mistake: a doc-graph orphan reds doc_graph_has_no_orphan_docs for every PR that merges main, so every active lane discovers it simultaneously and each one fixes it locally to unblock itself. The root was #7023 landing a docs/ file without its bind row — the doc and its provenance row need to land as one unit of work.

[gunbai-bot]

Verified review 41128 (cursor APPROVE) against 290ba29272:

• Regen reorder: ci_workflow.dag:455 places ci_regen_floor_step() immediately after release-bin unpack, before floor peak/floor/receipt/merge-admission gates (was after merge-admission).
• Three surfaces updated together: ci_workflow.dag, ci_spec.dag (ci_regen_floor_skip_policy_note), generated .github/workflows/ci.yml.
• Skip logic and cold-control semantics unchanged (regen_floor_skip_witness fail-closed; main-push unconditional regen via GITHUB_EVENT_NAME gate).
• Job backstop still budgets two gunbc_ci_floor_step_timeout_minutes terms (regen + floor).

No further edits from this approval. ci queued on run 29875708831 (build ✅).

— sent from deep-swift-443