ci: make Cargo with nextest the CI Gate Rust lane and retire the Bazel jobs

[DecisionNerd]

Closes #1644
Part of #1618

Implements ADR 0048 decision items 1–3 and 5 for the PR gate.

What changed

• .github/workflows/test.yml: replaces bazel-bootstrap with rust-tests (Rust Tests) on blacksmith-4vcpu-ubuntu-2404:

  • one shared target/ sticky disk, keyed by the toolchain (…-rust-tests-rust-1.96.0-target-v1), plus the usual registry cache;
  • cargo-nextest@0.9.145, installed through the repo's existing taiki-e/install-action SHA; Rust 1.96.0;
  • CARGO_INCREMENTAL=0 and dev/test debug=0, on the dev/test profile, so debug assertions and overflow checks stay on;
  • cargo nextest run --workspace --locked --no-fail-fast, excluding the two custom-harness binaries. It then runs cargo test --workspace --locked --test bdd --test disabled_allocations and cargo test --workspace --locked --doc. The follow-up steps run even when nextest fails, so one run reports every failure. All three go through scripts/test_environment.py --.
  • The offline progressive provider unittests and the tiny and ownership-growth lifecycle producer are kept. The producer now uses cargo build --locked -p graphforge-cli --bin gf → target/debug/gf.
  • It deletes the Bazel-only steps (bazelisk, drift check, migration ledger, live suite-membership inventory, cache-perf policy, Bazel evidence dir, Bazel binding packaging) and the whole bazel-diagnostics job.
  • ci-gate needs rust-tests, and require-gates.sh receives its result.

• scripts/ci/classify-changes.sh: the bazel output is renamed to rust_tests. Every Rust test-data path that set it still does: TCK, release workflows, reference docs, contract examples, crate goldens/snaps/fixtures/corpus, and agent-grounding. Bazel build descriptions no longer route to any CI Gate lane. Bazel scripts and docs fall through to the ordinary Python and docs rules. Unknown paths still enable_all.

• scripts/ci/test-classify-changes.sh: fixtures updated. It adds docs-only fixtures that expect rust_tests=false, and it checks that test.yml consumes rust_tests and never outputs.bazel.

• scripts/ci/test-ci-storage-policy.py: the Bazel-authority checks are replaced with Rust Tests lane checks:

  • exactly one job runs the workspace nextest suite, plus the custom-harness and doctest commands;
  • no Test Suite job id contains bazel or runs bazelisk;
  • only rust-tests may mount a sticky disk, and only its key at target;
  • no --release/--profile;
  • CI Gate needs equals the require-gates.sh arguments;
  • [profile.dev]/[profile.test] in Cargo.toml keep debug assertions and overflow checks.

  It drops the .bazelrc and Makefile assertions, which build: remove Bazel build descriptions, tooling, and docs (#1618) #1646 would otherwise trip on.

• .github/workflows/README.md: rewritten for the Cargo lane.

config/gate-registry.json needs no change: test-suite → github-status/CI Gate, exact_head. Ruleset 19988544 still requires only CI Gate, so the job display name is free to change.

Binding packaging smoke

//:binding_cdylibs //:python_wheel_smoke //:node_package_smoke proved that Bazel-built cdylibs could be assembled into a wheel and an npm zip by assemble_bazel_binding_packages.py, without maturin or napi. That is the Bazel→Binding RC handoff, and it has no meaning without Bazel. The existing Python Binding and Node Binding jobs already cover the Cargo path. They run on every rust or bindings change. They build the same-SHA wheel (maturin) and addon (napi), install them, and run the smoke, lifecycle, consumer, and notebook suites. No replacement step was added.

Local verification

• bash scripts/ci/test-classify-changes.sh: passed
• bash scripts/ci/test-require-gates.sh: passed
• make gate-registry-check: 14 tests OK
• python3 scripts/ci/test-ci-storage-policy.py: passed
• python3 scripts/ci/workflow_policy.py: exit 0
• scripts/check-workflows.sh (actionlint 1.7.12): exit 0
• make pre-push-fast: passed
• cargo nextest list -p graphforge-observability -E '<the lane filter>' with nextest 0.9.145 parses the filter and lists the unit tests without disabled_allocations.
• Mutations: six edits to test.yml were each rejected by the storage policy (CI Gate need removed, require-gates arg removed, --release added, retired sticky key, gating on rust instead of rust_tests, job renamed to bazel-bootstrap). Making *.md set rust_tests was rejected by the classifier test.

Docs-only acceptance criterion: the evidence is the classifier fixtures (docs/a file with spaces.md, docs/book/architecture/ast-and-planning.md, README.md → every output false, so rust-tests is skipped and require-gates.sh accepts skipped).

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: CurateLabs/graphforge/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 4a211588-7da4-4ef5-9273-74a8ccdb1001

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}