ci: the per-PR lane runs the full gate — all 24 shell suites, a conflict-marker lint, and a fast release-check on main

[Amperstrand]

What

Three lane gaps this cycle's regressions exposed, closed:

• The per-PR lane now runs the FULL packaging/uci-defaults suite set — 17 of 24 shell suites were lane-absent, which is exactly how feat(setup): the gateway serves NTP pre-auth — time before payment (#627) #648's class (rebrand-gutter red at pin-time) and test(packaging): an apk3 dependency-resolution smoke gates the release apk (dual-OS plan Phase 0.3, would have caught #552's class) #645's own apk-resolution gate reached main unverified.
• A conflict-marker lint (anchored to the marker-plus-space shape so prose/base64 never trip it) — the fix(lane): resolve the conflict-marker residue #658 left in run-conformance.sh #663 residue class can no longer be committed unremarked.
• make release-check-fast — the per-push shape of the gate (battery, deps, contract, packaging, the three invariant groups, version consistency; repro + conformance skipped via documented env), run automatically on main pushes. "Verify owed" becomes red CI in minutes instead of a remembered state.

Evidence

Full fast run on this branch: every leg PASS, READY FOR HARDWARE: YES in ~9 minutes (conformance/repro SKIP by design). YAML parses; the packaging leg runs all 24 suites exactly as release-check does locally.

[felixfelix-bot]

Tag legend: pre-release-safe = land before the pre-release you are testing · ready = no blocker, timing is yours · post-release = hold until after · needs-author-pass = back to the author.

TAG: pre-release-safe — this hardens the per-PR lane, which is what the pre-release testing depends on.

Checked the claim rather than trusting the title: the new step runs for t in tests/packaging/*_test.sh tests/uci-defaults-*_test.sh — a glob, not a hand-maintained list — and that is 24 suites, matching "all 24". It also adds the conflict-marker lint (the #663 class, i.e. exactly what bit us today) and make release-check-fast on main.

One precise note: three suites stay outside the per-PR lane — tests/ngit-ci-trigger_test.sh, tests/ngit-release-pipeline_test.sh, tests/verify_publication_test.sh. If that is deliberate (they need CI/publication context), a comment in the workflow saying so would keep the next reader from "fixing" the glob; if not, the globs miss them.

Stack: carries #692's and #693's commits.