chore(ci): tier B of the CI audit — the release cache pair and the site-node composite

[IvanWng97]

Tier B of the CI audit (items 8-11). Was #967, stacked on #966; that PR closed permanently when the merged base branch was deleted, so this is the same branch re-targeted at main (tier-A content arrives via a merge of the squash, auto-resolved).

What

• Release cache pair — the build and deb jobs rebuild the one shared target (aarch64-unknown-linux-gnu, identical flags since chore(ci): tier A of the CI audit — composites, caches, and one-authority pins #966's target-derived --no-default-features) into per-job caches; both now use shared-key: release-<target>. Honest scope, per review: a fresh tag still pays both cold (the jobs start together; tag caches are tag-scoped) — the wins are same-tag re-runs of a failed deb leg and one cache entry instead of two (cache is currently over the 10 GB ceiling).
• setup-site-node composite — pages.yml and site.yml shared ~20 verbatim lines of Node/npm/Playwright setup; the composite owns them. The Node major is a composite input (default 26) — one authority feeding setup-node and an output pages.yml forwards to withastro/action (which runs its own Node setup and would otherwise pick a different major). The ci-obs pin follows the moved step: the composite must keep the exact pinned npm install, and each workflow must call the composite un-conditioned exactly once. Both workflows' paths: lists now include the composite (review-caught: a composite-only change previously got zero runtime exercise).

Dispositions of the audit's items 9-10

• Item 9 (cache pressure) — the shared-key halves release's footprint; the broader levers (Linux job shared-key/save-if consolidation) need restore-rate measurement first — most main-branch jobs build with different flag sets, and forcing a shared key across them thrashes. Surfaced with that caveat.
• Item 10 (non-Rust PR skips) — the CodeQL half is REFUTED by mechanism: main.rego pins on.pull_request to exact-null ("any filter lets some PR merge unanalyzed"); changing that is a security-policy decision, not a cleanup. The ci.yml step-level skip design (~400 runner-min/week) remains available but wants its own design-gated PR: a changes-filter job + if: on expensive steps, inverted default, aggregators and policy untouched. Say the word and it becomes PR 3.

Review (two-lens gate)

3 lenses (correctness / design / whole-file comment audit): APPROVE-WITH-NITS ×2, REQUEST-CHANGES ×1 (both its HIGHs fixed — one on the parent branch as #966's round 2, one here). Fold ec88fdd4. Probe highlights: rust-cache shared-key semantics fetched from its README; every policy mutation fires the right deny (install deleted, call deleted, if: added — both levels); zizmor parses and still suppresses inside the composite; the deleted-outputs case is actionlint-caught while the input-shaped authority removes the dangling-id case structurally.

Deploy-watch note: withastro/action + the output forwarding live only in pages.yml, which never runs on PRs — watch the first main-push pages run's "setup node" step resolve Node 26 before trusting the chain end-to-end.

Surfaced: a bootstrap-before-npm ci ordering rule inside the composite (new gate — needs its own small PR if wanted); lighthouse_workflow_path naming debt (13 uses, site.yml's check job is 1-of-10 lighthouse).

🤖 Generated with Claude Code

https://claude.ai/code/session_01K6LG4b2iq2tRHvJ3AhFXDU

[github-actions]

Claude Security Review

Head: 370aafbf55a801c5efef1010f2b3fc0a59b55a42

Findings: 0 — No findings

This diff only refactors CI workflow/action YAML and OPA policy for the site build pipeline; it touches none of the defined trust boundaries (hook shim, socket/pipe transport, settings/config writes, path/home/process/credential handling, or transcript/hook/JSONL/pack ingestion), so there are no security-relevant changes.

---

Automated read-only review by Claude Code

[github-actions]

Claude Review

Head: 370aafbf55a801c5efef1010f2b3fc0a59b55a42

Findings: 0 — No findings

Clean CI-only refactor: dedupes the site's Node/npm/Playwright bootstrap from pages.yml and site.yml into a new .github/actions/setup-site-node composite, updates trigger paths, and rewrites the corresponding OPA rego rules and tests to match (github_workspace/pinned_npm_setup_steps cleanly replaced with site_node_action_installs/site_node_call_steps, no dangling references). Verified the composite's step order, working directories, node-version output propagation, and the release.yml rust-cache shared-key change (correctly scoped to the one target — aarch64-unknown-linux-gnu — both build and deb jobs actually share); no architecture-invariant, correctness, or DRY violations found.

---

Automated read-only review by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.73%. Comparing base (b37590c) to head (370aafb).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #968   +/-   ##
=======================================
  Coverage   95.72%   95.73%           
=======================================
  Files         197      197           
  Lines       58303    58303           
=======================================
+ Hits        55811    55814    +3     
+ Misses       2492     2489    -3     

Components	Coverage Δ
pixtuoid-core	97.67% <ø> (+0.01%)	⬆️
pixtuoid-scene	95.40% <ø> (ø)
pixtuoid	94.19% <ø> (ø)
pixtuoid-hook	96.54% <ø> (ø)
pixtuoid-web	95.78% <ø> (ø)
see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.