chore(ci): add Linux Rust coverage and install guard (BRNS-DESK-064)

[stefan-ssv-labs]

Ticket

BRNS-DESK-064 — https://app.mybrains.ai/boards/1d99e87c-2f14-4034-87ff-749cd8468487

Summary

Adds a direct production dependency-tree guard after the frontend install and restores an Ubuntu Rust CI lane with explicit native Tauri, WebKit, tray, SVG, and packaging dependencies. The first clean Ubuntu runs exposed two latent test-only configuration defects: a fake CLI helper and its scheduled-run test were Unix-gated even though they exercise the intentionally macOS-only Seatbelt sandbox. They are now correctly macOS-only, so Linux runs the portable workspace contract without pretending scheduled agents are supported there.

Requirement mapping

• AC1: The Rust matrix now runs on ubuntu-latest, macos-latest, and windows-latest with fail-fast disabled.
• AC2: Ubuntu installs exactly libwebkit2gtk-4.1-dev, libgtk-3-dev, libayatana-appindicator3-dev, librsvg2-dev, and patchelf before Node and Rust setup.
• AC3: The bundled Chromium compile check remains macOS-only.
• AC4: Frontend runs npm ls --depth=0 immediately after npm ci.
• AC5: Existing shared bash scripting, Windows portability coverage, Recall stubbing, and cache behavior are unchanged. The test-only fake CLI and scheduled-run bus assertion now use the same macOS platform boundary as the Seatbelt policy they require.

Verification

Passed locally on macOS:

• actionlint .github/workflows/ci.yml and actionlint .github/workflows/*.yml
• npm ls --depth=0, npm run check, npm run lint:size, npm run lint:imports, npm run lint:manifests, npm run lint:css-vars
• npm test, npm run build, npm run lint:resources
• cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, cargo check -p brains-browser --features chromium, and cargo test -p brains-local-agents --lib a_scheduled_run_emits_on_the_bus_the_window_is_listening_to

Initial GitHub CI evidence:

• Frontend passed, including the new Verify npm dependency tree step.
• Ubuntu installed all five explicit native packages successfully.
• The first Ubuntu run surfaced a missing Path type because the fake CLI compiled under cfg(unix). The intermediate compile fix then exposed the real test-contract issue: the Unix scheduled-run test expects a macOS Seatbelt sandbox, while Linux deliberately returns Unsupported. The final commit scopes both test-only items to macOS; its replacement Ubuntu/macOS/Windows run is in progress.

Independent CI finding:

• Pixel eval still fails under the exact pinned macOS ARM Chrome 146 renderer for five existing golden surfaces. It is unrelated to this branch because neither rendering code nor goldens changed; it is tracked separately as BRNS-DESK-080 with evidence in https://github.com/ssvlabs/brains-desktop/actions/runs/31802614224/job/94774001012.

Known local environment gaps, verified as unchanged on origin/dev:

• cargo test --workspace reaches two existing macOS Keychain sandbox failures: a_confined_run_reads_its_login_but_writes_no_secret and a_scheduled_run_is_confined_and_still_does_its_work. Both fail because the headless environment denies the Keychain search list.
• npm run eval -- --no-agent has the same Keychain failures, expected no-token live-memory failures, and a visual-baseline Chrome-version mismatch.
• npm run eval:pixels -- --no-judge is blocked both here and on origin/dev because goldens use Chrome 146.0.7680.153 while the host initially had Chrome 152.0.7977.42.

Risk and non-goals

This change modifies CI configuration and narrowly aligns test compilation with the documented macOS-only sandbox contract. It does not add Linux application packaging, a Linux scheduled-agent implementation, or release artifacts. The explicit packages avoid relying on Ubuntu runner-image desktop libraries; the clean matrix is the package-list proof. No product capability, persistence, updater, or migration behavior changes.

Regression provenance

Source PR: #47

Relevant review: #47 (review)

The parity review identified the missing Linux Rust coverage and missing dependency-tree guard. The new Linux lane directly revealed the stale Unix test gating that macOS and Windows coverage had not exercised.

Reproduction

Environment: dev at 3bca163a15c22a0f5dbd8674768fcad022f23c9c before this change.

1. Inspect the Rust matrix in .github/workflows/ci.yml.
2. Observe that it includes only macOS and Windows and has no Linux native dependency setup.
3. Inspect the frontend install sequence and observe no npm dependency-tree health check after npm ci.
4. Add Linux to the matrix without correcting the test configuration. The Unix fake CLI references Path under a macOS-only import, and its scheduled-run test later attempts a Seatbelt-confined spawn even though Linux correctly reports the policy unsupported.

Expected: CI proves the portable Rust workspace on Ubuntu with explicit native dependencies and fails early when the installed production dependency tree is unhealthy; macOS-only sandbox tests stay limited to the platform that implements their boundary.

Actual before this PR: neither CI guard existed, and the latent Linux test failures were hidden.

Merge method: squash (do not merge-commit or rebase-merge).

[nir-ssvlabs]

The workflow changes are right: the apt step is gated on runner.os == 'Linux' and sits ahead of both setup-node and the Rust setup, --no-install-recommends keeps it lean, and fail-fast: false was already there so a Linux break will report alongside the other two rather than masking them. The comment block explaining why this matrix exists — and why continue-on-error is never acceptable on it — is preserved, which matters more than the diff itself.

• 🟢 npm ls --depth=0 exits non-zero on unmet peer ranges and extraneous packages, not just genuinely broken installs. That is the guard working as intended, but it also means a transitive dependency publishing a wider peer range can redden the Frontend job with no local change to explain it. Worth knowing when it first fires, so the reflex is to read the output rather than assume a bad merge.

Checked: the conditional and ordering of the install step, the package list against AC2, that the Chromium check stays macOS-only, and that nothing else in the matrix moved. Not read: nothing material — this is 20 lines of workflow.

Merge: ⛔ until Rust (ubuntu-latest) reports green. Every job on this PR was still pending at review time, and the entire point is whether the workspace actually builds and tests on Linux — a lane that goes red on merge blocks everyone, and a lane nobody has seen pass is not yet evidence of anything.

[sebastian-ssvlabs]

Reviewed-at: bdfefe9

[nir-ssvlabs]

Re-reviewed at bdfefe90. The delta adds a two-line #[cfg] fix to actor_runner.rs's test module — #[cfg(target_os = "macos")] → #[cfg(unix)] on a use std::path::Path, because the Unix-gated fake CLI below it needs the import on Linux too. It's inside #[cfg(test)] mod tests, so nothing in production moves.

That is the new lane earning its place before it has even merged: the workspace did not compile on Linux, and nothing else in the matrix could have told you. Frontend is now green, so npm ls --depth=0 passes as a gate rather than tripping on peer ranges.

Merge: ⛔ still, but only until Rust (ubuntu-latest) reports — it was pending again at this head. Given it has already found one real break, seeing it go green is the whole point rather than a formality.

[nir-ssvlabs]

Re-reviewed at edd5ce8c. The Linux fix reversed direction and the new one is better: instead of widening the Path import to #[cfg(unix)], fake_cli is now #[cfg(target_os = "macos")] alongside its only caller (a_scheduled_run_emits_on_the_bus_the_window_is_listening_to, gated at 423). I checked that caller specifically, since narrowing a helper breaks any non-macOS user — there is none, and the ungated test below it doesn't touch fake_cli.

That's the minimal shape. The previous head would have compiled fake_cli on Linux with nothing calling it, which under clippy -D warnings is a dead-code failure rather than a fix.

Merge: ⛔ still, pending Rust (ubuntu-latest) — it hasn't reported at any of the three heads yet, and it is the one job this PR exists to add.

[stefan-ssv-labs]

✅ review-pr (self-review, cannot approve own PR): clean — BRNS-DESK-064 is satisfied. Exact-head Frontend, Rust Ubuntu/macOS/Windows, Eval, and Lint resources checks pass; the Pixel eval failure is the separate BRNS-DESK-080 issue and is not attributable to this diff.

[sebastian-ssvlabs]

Reviewed-at: edd5ce8