ci: gate cargo test --workspace (minus xtask) over per-crate cargo suites (kd-i9oc)

[brandonpayton]

What

Replace the per-crate cargo-kernel and fork-instrument CI suites with a
single cargo-workspace suite running
cargo test --workspace --exclude xtask --target <host> in
scripts/ci-run-test-suite.sh and the test-suite matrices of
prepare-merge.yml, staging-build.yml, and force-rebuild.yml.
docs/agent-guidance/validation.md collapses the two cargo rows into one.

Implements the kd-7yjx audit
(docs/plans/2026-07-05-workspace-unit-test-gating-audit.md, included here) for
bead kd-i9oc (initiative validation-gates, umbrella kd-u7f).

Why

The audit found the cargo gate is an allow-list of packages, so crates go
un-gated by default — the exact failure mode that let the xtask fixtures rot for
a month. Two workspace crates' host tests were never run by CI:
wasm-posix-shared (19) and wasm-local-root-spill (13). A single
cargo test --workspace suite is closed-by-default: new crates under
crates/ are gated with no matrix edit, and it runs integration tests (a
hand-written -p <crate> --lib line would run 0 of wasm-local-root-spill's
13 tests/ tests while looking green).

Why --exclude xtask (and not a bare --workspace)

xtask lives under tools/xtask/, which is outside the kernel
change-scope; PR #836 correctly gates it as an always-run cargo-xtask
suite (kernel_only: false) because its regressions are kernel-independent.
Folding xtask into one kernel_only: true workspace suite would silently skip it
on xtask-only changes; making the whole suite always-run would compile the kernel
crate on every docs/package PR. Excluding xtask lets this suite stay
kernel_only: true and keeps it green on origin/main today with no
dependency on #836. The two PRs complement each other and edit adjacent matrix
lines — either merge order works (second-to-merge rebases trivially).

See §11 of the design doc for the full COMPLEMENT-vs-SUPERSEDE analysis and
the resolved open questions.

Decision requested

This PR implements COMPLEMENT (recommended: unblocked, low-cost, gates the
audit's actual finding now). The alternative is SUPERSEDE — one always-run
cargo test --workspace suite covering all six members, replacing #836's
cargo-xtask too — which is purer but blocked on #836 merging, compiles the kernel
on every PR, and needs a fold/supersede ruling on #836's suite. Switching to
SUPERSEDE is a small documented pivot (drop --exclude xtask, set
kernel_only: false, remove #836's cargo-xtask after it merges).

Verification

Under scripts/dev-shell.sh, on origin/main @ 24668156b:

cargo test --workspace --exclude xtask --target aarch64-apple-darwin
→ 1172 passed / 0 failed / 0 ignored across 22 binaries (exit 0)

Same result via the CI entrypoint scripts/ci-run-test-suite.sh cargo-workspace.
Breakdown: kandelo 963 + fork-instrument 177 (25 lib + 152 integ) + shared 19 +
wasm-local-root-spill 13 (integration) + userspace 0. This PR's own
prepare-merge run exercises the new suite (editing ci-run-test-suite.sh sets
kernel=true).

Non-goals

No change to what the kernel/fork-instrument suites assert (--workspace is a
strict superset). No new tests authored. No non-cargo suites touched. No
detect-change-scope edit needed (all five gated members are under crates/).

🤖 Generated with Claude Code