[Sukitly]

Summary

• replace the copied local aggregate gates with direct GitHub Actions jobs
• run platform-independent unit and contract_* tests once in the required Core check
• run the complementary external-effect suite natively in the required Linux and macOS checks
• keep native release builds and package validation on both supported platforms
• delete the obsolete Docker Linux replica and local check-{host,linux,all}.sh orchestrators
• make every top-level scripts/*.py file an executable command with a precise name
• move import-only artifact and archive modules under non-executable scripts/_lib/
• document GitHub Actions as the only complete merge gate while retaining targeted local Red/Green commands

Test partition

.config/nextest.toml defines complementary fail-safe profiles:

• ci-core: pure library unit tests and contract_* binaries
• ci-host: every other test, including CLI, Git, SOPS, identity, filesystem, runtime, and package behavior

The partition currently resolves to:

• Core: 105 tests
• Host: 154 tests
• overlap: 0
• union: all 259 tests

The workflow verifies disjointness and exhaustiveness before running the Core suite. New integration binaries default to the dual-platform host suite unless deliberately named contract_*.

Script boundary

Executable commands live directly under scripts/:

• check-functional-core.py
• check-doc-links.py
• fetch-test-sops.py
• fetch-test-age-keygen.py
• build-release-archive.py
• install-from-source.py

Import-only modules live under scripts/_lib/ and are not executable:

• age_keygen_artifacts.py
• sops_artifacts.py
• release_archive.py

GitHub Actions security

• GitHub-hosted ephemeral runners
• pull_request, never pull_request_target
• read-only repository token permissions
• checkout credentials are not persisted
• third-party actions remain pinned to full commit SHAs
• no repository secrets, publishing permissions, self-hosted runners, or additional cache actions

Local validation

• targeted package contract: 7 passed
• Nextest profile enumeration: Core 105, Host 154, overlap 0, union 259
• inherited IPC serialization configuration
• all top-level script entry points are executable; all _lib modules are non-executable
• Rust formatting
• architecture and documentation checks
• Python and shell syntax
• workflow YAML syntax
• patch whitespace, obsolete-reference, English-only, and private-reference scans

The Core, Linux, and macOS jobs in this pull request are the complete acceptance test for the workflow change.