V2.10.S6: CI cutover to fully-qualified recipes

[deeprnd]

V2.10.S6: CI cutover to fully-qualified recipes

Status: Backlog
Epic: #[github-epic-issue]
Parent roadmap item: V2.10: Build System Consolidation And Qt Build Validation
Labels: type/story, area/platform

Update all 7 CI workflow files to call fully-qualified recipe names directly
(Principle 4 from build-tooling-consolidation.md). No new scheduled lanes — the
same jobs that run today run with fully-qualified names.

Product Outcome

CI behavior never depends on runner-detected OS/arch — only on which job matrix
entry GitHub scheduled. Every run: line names a fully qualified recipe like
just test-unit-tk-linux-x86 instead of relying on the composite action's
inline branching or bare auto-detecting dispatchers.

User Story

As a CI workflow author, I want every run: line in my workflow to name a
fully-qualified recipe, so that my CI lane is reproducible and independent of
runner platform detection.

Scope

• In scope: update all 7 workflow files in .github/workflows/ to use
  fully-qualified recipe names for every just call.
• In scope: update .github/actions/setup-public-gh-runner/action.yml to call
  just setup-{os}-{arch}[-{compiler}] instead of containing 100+ lines of
  inline if: runner.os == branching (cross-references S5).
• In scope: update .github/actions/deps/action.yml to use platform.sh or
  just variables for platform detection instead of runner.os/runner.arch
  branching for zstd installation.
• In scope: no new CI lanes or schedule changes — the exact same jobs that run
  today run with fully-qualified names (D5 from build-tooling-consolidation.md).
• In scope: verify every existing CI lane still passes after the cutover.
• In scope: update doc/execution/ci.md to document the fully-qualified
  naming convention and remove references to bare recipe names.

Preconditions And Assumptions

• S1 (platform.sh + cleanup) has shipped.
• S4 (justfile fully-qualified recipe names) has shipped.
• S5 (setup-* recipes) has shipped (for the setup-public-gh-runner conversion).
• The 7 workflow files are: build-tk.yml, build-fd.yml, quality.yml,
  security.yml, tests-short.yml, tests-full.yml, and the composite action
  setup-public-gh-runner/action.yml (plus deps/action.yml).
• D5: No new CI lanes. Consolidate only what already runs.

Acceptance Criteria

• Given every workflow file, when the runner processes a run: line
  containing just build-fd, then it has been updated to the fully-qualified
  form (e.g., just build-fd-linux-x86-gcc).
• Given every workflow file, when the runner processes a run: line
  containing just test-unit-tk, then it has been updated to the
  fully-qualified form (e.g., just test-unit-tk-linux-x86).
• setup-public-gh-runner/action.yml calls just setup-{os}-{arch}[-{compiler}]
  instead of containing inline platform branching.
• deps/action.yml uses platform.sh or just variables for platform
  detection.
• No new CI lanes or scheduled jobs have been added beyond what already
  exists today.
• Every existing CI lane passes after the cutover.
• ci.md documents the fully-qualified naming convention.

Conditional Acceptance

Financial capability and policy

• N/A - story modifies CI workflow files; no policy changes.

Audit and replay

• N/A - story modifies CI workflow files; no audit/replay changes.

Runtime topology and tile ownership

• N/A - story modifies CI workflow files; no topology changes.

Model, tool, adapter, or execution boundary

• N/A - story modifies CI workflow files; no model/adapter/execution changes.

CaseOps API or UI

• N/A - story modifies CI workflow files; no API/UI changes.

Storage role: Memory, Analytics, Ledger

• N/A - story modifies CI workflow files; no storage changes.

Metrics, diagnostics, and operations

• N/A - story modifies CI workflow files; no metrics/telemetry changes.

Security and fail-closed behavior

• Given a workflow file, when a run: line calls a just recipe, then
  it uses the fully-qualified form and never a bare auto-detecting form.

Evidence Plan

• Demo or command: trigger a PR on the target branch and verify all CI lanes
  pass with the new fully-qualified recipe names.
• Tests: CI lane results are the primary evidence.
• Fixtures or samples: Updated workflow files.
• Audit/replay evidence: N/A - CI workflow only.
• Blocked-flow evidence: A lane that fails after cutover is investigated and
  fixed before merging.

Quality Gate

• All 7 workflow files use fully-qualified recipe names.
• setup-public-gh-runner/action.yml is a thin wrapper calling just setup-*.
• deps/action.yml uses platform.sh for platform detection.
• No new CI lanes added.
• All existing CI lanes pass.
• ci.md is updated.
• Documentation and roadmap status are updated.

Notes And Open Questions

• How many workflow files are there exactly? S6 should start by listing them.
  The build-tooling-consolidation.md says "7 workflow files" — verify this count.
• test-unit-fd-macos-x86 may hit the pre-existing blst/zstd/lz4
  macOS x86_64 vendor-source blocker per D3. If the CI lane for macOS x86
  runs test-unit-fd-macos-x86, it may fail independently of the cutover.
  Document this as a known issue against FD vendor sources.