Consolidate the workflows and ship prebuilt

[jserv]

artifact-scans.yml folds into ci.yml as a job of its own. A guard in repo-guards.rs had to learn to read every file under .github/workflows before it could see that a whole gate ran in the second file, which is the failure that guard exists to prevent, one file over.

The paths-ignore filter is gone. It skipped every job on a push touching only markdown, which skipped cargo test --test unit and check-artifacts.sh, the two gates that read the markdown. The filter turned off precisely the checks for the files being changed.

A build job produces Linux x86_64 and macOS arm64 tarballs and runs each binary on the platform it was built for, and a release job republishes them as a rolling "latest" on every green push to main. Cargo.lock is tracked and the build passes --locked, so a published binary is a function of the commit that names it. The fast lane gains a macOS leg for the same reason the build job runs what it produced: the tarball ships for a platform no test had run on.

repo-guards.rs gains released_tarball_names_match_the_build_matrix, pinning the asset names in the build matrix, the release job and README to one list. The release job checks its own copy against the artifacts at run time; README's copy was checked by nothing, and a renamed target would have left it pointing at a download that 404s while every gate stayed green. ci_runs_every_test_target now reads the one-line "run:" form as its two siblings already did. It saw only the block form, so it reported test-integration as run by nobody once that step no longer needed a block.

---

Summary by cubic

Consolidates CI into one workflow and ships prebuilt Linux x86_64 and macOS arm64 binaries via a rolling latest release. Tracks Cargo.lock and builds with --locked so published binaries are reproducible by commit.

• CI and release

  • Single .github/workflows/ci.yml with four jobs: Rust unit/build on Ubuntu+macOS, artifact scans, Frama‑C 33.0 integration, and binary build.
  • Removes paths-ignore so docs-only pushes run the full lane; adds macOS to the fast lane.
  • Release runs only on green pushes to main, stages an exact asset list, smoke-runs each built binary, and safely replaces latest (no cancel-in-progress on main, explicit 200/404 checks).

• Guards, docs, maintenance

  • Adds released_tarball_names_match_the_build_matrix; unifies YAML step parsing; gate discovery now scans all files under .github/workflows.
  • scripts/check-artifacts.sh flags links to untracked/missing files; tests drop references to CLAUDE.md.
  • README documents stable download URLs; .gitignore stops ignoring Cargo.lock; adds .github/dependabot.yml for weekly github-actions and cargo updates.

^{Written for commit 2c2fb0b. Summary will update on new commits.}