test: guardrail Review-queue specs on dedicated servers -- kills the cohabitation flake (#215)

* fix: guardrail e2e isolation -- dedicated per-test server, split file

guardrail.spec.ts ran on the shared per-worker server pool, so its
Review-queue assertions (exact pending/resolved rows, filter options,
the sidebar badge count) could be contaminated by another spec
cohabiting the same worker (mcp-write-cancel.spec.ts parking its own
MCP approval), producing CI-only failures that never reproduced
locally solo.

Converts every test to the dedicated-server-per-test pattern
guardrail-authoring.spec.ts already uses (own chromium.launch +
spawnMillServer per test, own port pair, mkdtemp dirs, finally-
stop+rm). The converted file crossed the 500-line limit, so the
Review-queue tests move to a new guardrail-review.spec.ts on its own
disjoint port pair. mcpTestClient.ts's connectMCPClient gains an
optional explicit port for specs that aren't on the standard
per-worker pool.

The filterable-by-workflow test's own dedicated server starts with no
run history at all, so it now also resolves a second workflow's
review item itself (the filter's option list only ever contains
workflows with an existing pending/resolved item) instead of relying
on another test's residual state, which no longer exists once each
test gets its own isolated server.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FW5GkkAG8du7tNdYLk2zSd

* ci: e2e 3 -> 4 shards -- dedicated-server boots pushed two shards past the 15m cap with zero failures

The recorded revisit trigger (testing.md) fired: pure cap-kills, no
red tests. Shard growth is the named lever.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FW5GkkAG8du7tNdYLk2zSd

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: alicoding

.github/workflows/ci.yml

@@ -328,8 +328,12 @@ jobs:
       # states for its own fail-fast: false, applied here too.
       fail-fast: false
       matrix:
-        shardIndex: [1, 2, 3]
-        shardTotal: [3]
+        # 4-way since the guardrail specs moved to per-test dedicated
+        # servers: the added boot time pushed two 3-way shards past
+        # the 15-minute job cap with zero failing tests -- the exact
+        # revisit trigger testing.md records for shard growth.
+        shardIndex: [1, 2, 3, 4]
+        shardTotal: [4]
     env:
       # Required for the same reason as build-go's ubuntu-latest entry:
       # playwright.config.ts's webServer builds the real server-mode

frontend/e2e/fixtures/server.ts

@@ -273,3 +273,28 @@ export const ATLAS_SELECT_GROUP_MCP_BASE_PORT = 10080
 // test -- same own-server-own-ports reasoning as persistence.
 export const ATLAS_SESSION_SERVER_BASE_PORT = 10100
 export const ATLAS_SESSION_MCP_BASE_PORT = 10120
+
+// guardrail.spec.ts's own dedicated pair: its Review-queue assertions
+// (exact pending/resolved rows, kind-filter narrowing, the sidebar
+// pending-count badge) must never be contaminated by another spec
+// cohabiting the standard per-worker pool's one shared server (e.g.
+// mcp-write-cancel.spec.ts parking its own MCP approval on the same
+// worker) -- same own-server-own-ports reasoning as guardrail-
+// authoring above, one class of bug applied to this file's own
+// Review-queue state.
+export const GUARDRAIL_SPEC_SERVER_BASE_PORT = 10140
+export const GUARDRAIL_SPEC_MCP_BASE_PORT = 10160
+
+// guardrail-review.spec.ts's own dedicated pair -- guardrail.spec.ts's
+// Review-queue tests split into this second file once the converted
+// file crossed the 500-line hand-written-file limit
+// (.claude/rules/architecture.md); its own port pair rather than
+// reusing GUARDRAIL_SPEC_* above, so the two files' worker-time
+// lifetimes can never overlap on the same ports even though same-file/
+// same-worker serialization no longer makes that a correctness risk.
+export const GUARDRAIL_REVIEW_SERVER_BASE_PORT = 10180
+// Kept well clear of the server range above: 8 tests x up to 10-per-
+// test offsets x up to 4 workers pushes the server range itself past
+// 10250, so the MCP base must start beyond that or a computed server
+// port can land on another test's MCP listener.
+export const GUARDRAIL_REVIEW_MCP_BASE_PORT = 10300