ci: the tests gate the publish — ci.yml folds into build.yml

Operator, 2026-09-23: *"tighten the gate so :dev can't publish on red tests"*,
then *"I don't want failing builds to publish anywhere going forward."*

Run 7348 is the worked example. The backend unit lane went red on `2f8f0bc`
and `build-web` pushed `:dev` in the same minute, because the lanes and the
build were SEPARATE WORKFLOWS on the same push trigger. Neither could see the
other's verdict. `:dev` was a "it built" signal, never a "it passed" one, and
nothing about that was visible from either run.

Two workflows cannot express the gate. A `needs:` edge only exists inside one
graph. So `ci.yml`'s five lanes move into `build.yml` and `ci.yml` is deleted;
`sign-extension`, `build-web` and `build-agent` now need all five.

Nothing here is a new mechanism — it is the same edge that has gated `promote`
since milestone 362 step 4, and it keeps that step's hardest-won property:
**not running is not the same as passing.** `needs` treats a SKIPPED
dependency as unsatisfied, so a lane that silently skips itself blocks the
publish exactly as a failing one does. Run 5290 is why that is worth stating.

Scope, said plainly rather than implied:

- Gated: every image tag (`:dev`, `:latest`, `:c-<sha>`), the weekly base
  refresh, and the `ext-<version>` signed-XPI release asset — `sign-extension`
  publishes too, so it is gated with the rest.
- Not gated, deliberately: `extension.yml` publishes nothing, and
  `release.yml` runs on a `v*` tag, generates notes rather than an artifact,
  and its commit already went through main's gated build.
- `pull_request` (Renovate bumps into `dev`) comes across with the lanes. Its
  runs are the lanes and nothing else, via an `if:` on each publishing job
  rather than an inference from the `needs` chain.

The cost, accepted knowingly: this workflow queues per branch and never
cancels, so on two pushes in quick succession the second's lint feedback waits
out the first's build. A slower red beats a fast red that ships.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LVjrnpQjRgHdvq95rASoiR

extension/README.md

@@ -68,7 +68,7 @@ rejected, and at most four segments are allowed. The extension therefore emits
 **the same numbers unpadded**: `2026.8.29.201` where the rest of the family
 says `2026.08.29.0201`. Rule 148 already defines comparison as numeric per
 segment, under which the two are equal, so nothing is reordered by the choice
-and left-padding each segment recovers the family string exactly. `ci.yml`'s
+and left-padding each segment recovers the family string exactly. `build.yml`'s
 `extension-version` lane checks the derived string against that regex on every
 push — the cheap place to find out, because AMO 409s on re-signing and a
 rejected version is burned for good.

extension/package.json

@@ -3,7 +3,7 @@
   "version": "1.0.11",
   "private": true,
   "description": "Firefox extension for FabledCurator",
-  "comment_ignore_files": "The --ignore-files list comes from scripts/packaging.sh, the single source of truth shared with ci.yml's guard and the derived-version patch count. `set -f` is REQUIRED before the substitution: without it the shell globs `test/**` against the working tree and silently narrows the pattern to whatever files happen to exist.",
+  "comment_ignore_files": "The --ignore-files list comes from scripts/packaging.sh, the single source of truth shared with build.yml's guard and the derived-version patch count. `set -f` is REQUIRED before the substitution: without it the shell globs `test/**` against the working tree and silently narrows the pattern to whatever files happen to exist.",
   "scripts": {
     "lint":  "set -f; web-ext lint --source-dir=. --no-config-discovery --ignore-files $(sh scripts/packaging.sh ignore)",
     "start": "set -f; web-ext run --source-dir=. --no-config-discovery --ignore-files $(sh scripts/packaging.sh ignore) --firefox=firefox",

extension/test/version.spec.js

@@ -10,7 +10,7 @@ const readText = (...seg) => readFileSync(path.join(EXT_DIR, ...seg), 'utf8')
 
 // Only the git-free subcommands are exercised here: `version` shells out to
 // git, and the extension lane runs on node:24-bookworm-slim which may not ship
-// it. That one is covered where git is guaranteed — ci.yml's extension-version
+// it. That one is covered where git is guaranteed — build.yml's extension-version
 // lane and build.yml both run on ci-python.
 const packaging = (cmd) =>
   execFileSync('sh', [path.join(EXT_DIR, 'scripts', 'packaging.sh'), cmd], {
@@ -39,7 +39,7 @@ describe('packaging.sh — the single definition of what ships', () => {
   it('emits glob patterns literally, never expanded against the working tree', () => {
     // The script iterates its lists with deliberate word-splitting, so it must
     // run with pathname expansion off. Without that, invoking it from a cwd
-    // where test/ exists (exactly how ci.yml and vitest call it) expands
+    // where test/ exists (exactly how build.yml and vitest call it) expands
     // `test/**` into the individual spec files, and the pathspec silently stops
     // covering anything added later.
     const pathspec = packaging('pathspec')
@@ -116,7 +116,7 @@ describe('consumers delegate rather than keeping their own copy', () => {
   )
 
   it('no workflow hardcodes the packaged-file set', () => {
-    // ci.yml used to substitute `packaging.sh pathspec` directly, for the
+    // build.yml used to substitute `packaging.sh pathspec` directly, for the
     // manual-bump guard that milestone 271 step 5 retired. Nothing inlines the
     // set today, and nothing should start to: a literal :(exclude)extension/...
     // in a workflow means someone bypassed the shared definition, which is
@@ -157,7 +157,7 @@ describe('extension version', () => {
     //
     // It is still asserted, for one reason: `npm run build` locally packages
     // whatever is committed, so a value AMO would reject turns a local build
-    // into a confusing failure with no CI signal ahead of it. ci.yml checks
+    // into a confusing failure with no CI signal ahead of it. build.yml checks
     // the same grammar against the DERIVED value, which is the one AMO sees.
     for (const file of ['manifest.json', 'package.json']) {
       expect(read(file).version, `${file} version is not AMO-shaped`).toMatch(AMO)