CI Hardening: Add complementary required checks beyond cert-gate SPOF

[IanFrelinger]

Summary

Eliminates the cert-gate single point of failure by adding three fast, complementary required checks that run on every PR. If cert-gate is cancelled, flaky, or times out, the other gates still prevent merge of broken code.

Changes

• Added build-gate.yml: Fast compile check (~2-3 min) that catches build breakage before heavier test gates run
• Updated cert-gate.yml: Added 60-minute timeout for robustness
• Updated docs-link-check.yml: Removed path filter to run on all PRs (~30s)
• Updated shell-lint.yml: Removed path filter to run on all PRs (~30s)
• Updated .github/workflows/README.md: Documented CI hardening strategy and required checks for repository administrators

Before/After CI Surface

Before

• Required checks: 1 (cert-gate only)
• Risk: If cert-gate is cancelled or flaky, broken code can merge

After (when branch protection is updated)

• Required checks: 4 (cert-gate, build-core, shell-lint, lychee (README + docs))
• Total added time: ~3 minutes (build-core 2-3 min + shell-lint 30s + docs 30s)
• Redundancy: If any single check fails/is-cancelled, merge is still blocked
• Coverage: Build breakage, shell syntax errors, broken docs, and hermetic certification

Testing

This PR adds CI infrastructure. The new workflows will run automatically on this PR:

• ✅ build-gate will verify the core solution compiles
• ✅ shell-lint will verify shell script syntax
• ✅ docs-link-check will verify documentation links
• ✅ cert-gate will run hermetic certification tests (existing)

Testing strategy (blast radius)

• Not applicable — CI workflow changes only
• New workflows tested via PR CI run
• Documentation updated (.github/workflows/README.md)

Action Required (Repository Admin / CEO)

To complete the CI hardening, a repository administrator must update branch protection settings:

1. Navigate to Settings → Branches → Branch protection rule for master
2. Under "Require status checks to pass before merging", add these required checks:
   • build-core
   • shell-lint
   • lychee (README + docs)
3. Keep cert-gate as required (existing)

Note:cert-gate remains required and is NOT weakened. These additional checks add redundancy without replacing the primary certification gate.

Checklist

• make test not applicable (CI workflow changes)
• Documentation updated (.github/workflows/README.md)
• No TODO or NotImplementedException left unresolved
• No breaking changes

Release (only when this PR ships a versioned NuGet/GHCR release)

• Not a versioned release — skip

[cursor]

✅ CI Hardening Validated

All new required checks have completed successfully on this PR:

• ✅ build-core — Core compilation check passed
• ✅ shell-lint — Shell script syntax validation passed
• ✅ lychee (README + docs) — Documentation link check passed
• ✅ cert-gate — Hermetic certification tests passed

This demonstrates the redundancy in action: four independent gates that must all pass before merge.

Next step: Repository administrator should update branch protection settings to require these checks (see PR description for instructions).

[cursor]

⏱️ CI Performance Analysis

Actual timing from this PR's CI run:

Check	Duration	Purpose
lychee (README + docs)	~6s	Documentation link validation
shell-lint	~12s	Shell script syntax check
build-core	~1m 56s	Core solution compilation
cert-gate	~2m 51s	Hermetic certification tests

Total added time: ~2 minutes (docs + shell-lint + build-core)

Redundancy benefit: If any single check is cancelled, flaky, or fails, the other three still block merge. The fast checks (18s combined) provide immediate feedback, while build-core catches compilation errors before the heavier cert-gate runs.