ci: split bazel-bootstrap diagnostics out of required CI Gate path

[DecisionNerd]

Summary

Required Bazel Bootstrap currently mixes authoritative gates (drift, ledger, //:ci_rust_tests, binding smokes) with diagnostic dual-build parity and cache observe/collect. Fabricated zero-hit JSON via || echo can mask harness failures. Checked-in perf-sample.json is treated as a live regression gate rather than one-shot M2 evidence.

Acceptance criteria

• Required bazel-bootstrap keeps drift, ledger/parity unit tests, //:ci_rust_tests, and binding cdylibs/smokes
• Dual-build parity + cache observe/collect move to non-required bazel-diagnostics job not in ci-gate needs
• Remove fabricated zero-hit || echo JSON fallback; fail closed on harness crashes
• Document perf-sample.json as one-shot M2 evidence (not a live evaluate regression gate)
• CI Gate still requires the slim authoritative bazel-bootstrap result

Non-goals

• Binding RC Bazel cutover (PR11)
• Pre-push Bazel (PR8)

BDD

• Given Bazel path is enabled, When dual-build parity or cache observe fails, Then CI Gate can still pass if authoritative bootstrap passed
• Given cache log parse harness crashes, When diagnostics run, Then the job fails (no zero-hit fabricated JSON)

Source

Devinfra Audit Fix-It Plan Wave C / PR7

[coderabbitai]

🔗 Related PRs

#278 - fix(ci): retain certification evidence as artifacts [merged]
#422 - build(bazel): model PyO3/napi cdylibs and packaging handoff (#7) [merged]
#425 - build(bazel): Blacksmith cache policy + cold/warm perf harness (#5) [merged]
#426 - build(bazel): verify Blacksmith remote cache hits and collect perf pairs (#5) [merged]
#427 - build(bazel): cut over CI Gate, retain rollback, retire PR Cargo sticky disks (#4) [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!