ci: census pnpm acquisition by need, not by mechanism spelling

.github/workflows/lint.yml

@@ -1654,6 +1654,30 @@ jobs:
  - name: Node-version drift guard
  run: pnpm check:node-version
 
+ # pnpm-acquisition census. Sibling of the guard above, and here for the
+ # failure the guard above cannot have: a census that reaches ZERO while
+ # the thing it measures is still there. The `corepack enable` sites are
+ # moving onto .github/actions/setup-pnpm, and when that finishes a grep
+ # for `corepack enable` returns 0 — a true answer about Corepack that
+ # reads as a complete answer about pnpm acquisition. It is not one:
+ # showcase-smoke.yml acquires pnpm through `pnpm/action-setup`, which
+ # contains no Corepack string and is invisible to that key. A metric that
+ # hits zero while its subject survives is worse than no metric, because it
+ # retires the attention.
+ #
+ # So this gate is keyed on the NEED, not the mechanism: the population is
+ # every job that RUNS pnpm. A mechanism nobody has taught it cannot become
+ # a silent zero — it surfaces as a job running pnpm with no recognised
+ # acquisition, which fails loudly. It prints the full census on SUCCESS
+ # (every mechanism keeps a row, including the ones at 0), so the answer to
+ # "how does CI get pnpm" is one job log rather than a grep nobody thinks
+ # to re-derive. It also pins the ordering that killed two jobs in this
+ # repo with "Unable to locate executable file: pnpm": a setup-node asking
+ # for the pnpm store cache shells out to pnpm, so pnpm must be acquired
+ # strictly earlier. Runs its own --self-test first.
+ - name: pnpm-acquisition census
+ run: pnpm check:pnpm-acquisition
+
  # Workflow status-function guard (#5343, from #4900 and #4928). GitHub
  # wraps any `if:` that names no status function in an IMPLICIT success().
  # So a job-level condition written to read an upstream job's OUTPUT VALUE

.github/workflows/showcase-smoke.yml

@@ -19,6 +19,31 @@ jobs:
  timeout-minutes: 45
  steps:
  - uses: actions/checkout@v7
+ # ⚠️ This is the ONLY job in the repo that acquires pnpm through
+ # `pnpm/action-setup`, and the only one using setup-node's `cache: pnpm`.
+ # Those are the same fact, and the order below is load-bearing — read this
+ # before "tidying" it onto `.github/actions/setup-pnpm` like every other
+ # caller.
+ #
+ # `cache: pnpm` makes setup-node shell out to pnpm to locate the store, so
+ # pnpm must already be on PATH when setup-node runs. That is the OPPOSITE
+ # ordering from every setup-pnpm caller here (setup-node first, then the
+ # composite). Getting it backwards does not degrade, it kills the job in
+ # the setup step with "Unable to locate executable file: pnpm" — the
+ # failure `partof-closing-keyword-guard.yml` and `single-claim-path-guard.yml`
+ # both carry receipts for. `pnpm check:pnpm-acquisition` fails on that
+ # inversion, so the naive conversion is caught rather than shipped.
+ #
+ # Converting is therefore not a swap: it means DROPPING `cache: pnpm` and
+ # adding the house pair (`pnpm store path` → actions/cache, as ci.yml does
+ # seven times over). Deliberately not done here. This job is nightly and
+ # non-blocking, its one uncached pnpm download is a single fetch rather
+ # than the per-queue-build multiplier the composite was built to remove,
+ # and the restructure trades that for re-plumbing the dependency cache of
+ # a green job nothing gates on. The site is not hidden by staying: it is
+ # counted and printed by `pnpm check:pnpm-acquisition`, which is keyed on
+ # jobs that RUN pnpm rather than on any one spelling — precisely so this
+ # path cannot vanish from a `corepack enable`-shaped census again.
  - uses: pnpm/action-setup@v6
  - uses: actions/setup-node@v7
  with:

package.json

@@ -104,6 +104,7 @@
  "check:release-page-status": "node scripts/check-release-page-status.mjs --self-test && node scripts/check-release-page-status.mjs",
  "check:release-body": "node scripts/release-github-releases.mjs --self-test",
  "check:node-version": "node scripts/check-node-version.mjs",
+ "check:pnpm-acquisition": "node scripts/check-pnpm-acquisition.mjs --self-test && node scripts/check-pnpm-acquisition.mjs",
  "check:workflow-status-functions": "node scripts/check-workflow-status-functions.mjs --self-test && node scripts/check-workflow-status-functions.mjs",
  "check:shard-attestation": "node scripts/check-shard-attestation.mjs --self-test && node scripts/check-shard-attestation.mjs",
  "check:required-contexts": "node scripts/check-required-contexts.mjs --self-test && node scripts/check-required-contexts.mjs",