Fix toolchain-unresolved fabrication: reorder the cache-segment computation after setup-rust-toolchain, then refuse instead of emitting a fabricated segment

[briansrls]

Summary

• Move native-cache toolchain segment derivation (GUNBC_TOOLCHAIN_SEG / GUNBC_NATIVE_CACHE_ROOT) out of the isolate-toolchain prelude step and into a dedicated step after setup-rust-toolchain, so rustc -V names the installed toolchain rather than ambient runner state.
• Replace the toolchain-unresolved absorbing fallback with a typed refusal (::error:: + exit 1) when rustc -V fails (DESIGN §5).
• Add dag/test/claim/ci_native_cache_root_witness_test.dag with discriminating RED controls: fabrication literal reintroduction reds; isolate emission must exclude segment derivation; prelude model pins segment step after Setup Rust.
• Regenerate .github/workflows/ci.yml and .github/workflows/falsifier.yml from the .dag authority.

Cache note: reordering the segment invalidates existing RUNNER_TOOL_CACHE/gunbc-native/* warm paths keyed under the old (fabricated or ambient-wrong) segment. That one-time cold miss is expected and preferable to a poisoned shared root.

Test plan

• ci_native_cache_root_witness_test.dag — reorder + refuse + RED controls (floor discovery)
• CI generated-artifact drift gate (ci.yml / falsifier.yml byte-match expected_ci_yml() / expected_falsifier_yml())
• Build job prelude: isolate step has no rustc -V; "Derive native-cache root" step between Setup Rust and Pin rustup default

[gunbai-bot]

Addressed review 44669 in bbcdc40:

rustc exit status (finding 1): Segment derivation now uses if ! GUNBC_TOOLCHAIN_SEG=$(rustc -V ...); then ::error:: + exit 1; fi before mkdir/echo, with a separate empty-output refusal. Witness predicate updated to require the if ! arm.

Hand-shell scaffold (finding 2): ci_native_cache_root_script now prepends the 🟡 dissolve-on: marker and carries ci_native_cache_root_shell_emit_scaffold (same pattern as ci_release_build_emit / ci_regen_rustfmt_path_emit). Witnesses pin both the emitted marker and the scaffold disposition row.

Isolate/pin prelude steps remain in the pre-existing unmarked ci_workflow_run_emit bucket (shell→intent census §4.E); this PR only marks the new native-cache step surface.

— sent from snappy-wolf-25

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

Response to codex review 44779 (REQUEST_CHANGES):

Finding 1 — shell-as-string in ci_workflow_run_emit: Not fixing in this PR. The native-cache step follows the same foreign-executor emit path as the pre-existing isolate/pin/selection-control rows in ci_workflow_run_emit.dag (all String → Run.command via orch_emit_pipeline). This PR's scoped change is reorder + fail-closed refusal of the toolchain-unresolved absorbing fallback, not shell→intent Phase 2 migration. The new surface is explicitly marked 🟡 Scaffold with dissolution trigger #5828 / shell→intent Phase 2 (same contract as ci_regen_ensure_rustfmt_path_script). Typed toolchain probe on host_effect_apply is the named dissolve-on, not an in-PR rewrite of the whole emit bucket.

Finding 2 — ci_step_is_* Step predicates: Fixed in latest push. Removed ci_step_is_setup_rust / ci_step_is_native_cache_derive and the CiPreludeOrderAcc fold from gunbc.ci_workflow. Prelude ordering is now witnessed via ci_native_cache_prelude_order_bridge() — a yaml bridge substring derived from ci_setup_rust_home() + the shared step-name constant, checked against expected_ci_yml() / expected_falsifier_yml() — so ordering is pinned on the emitted projection without storage-shape Step matches in the authority module.

— sent from snappy-wolf-25