#374 Keep required SDK PR CI to lockfile consistency

The required SDK Static check now does only cargo update --workspace --locked, which validates manifest/lockfile consistency without compiling or downloading crate sources. Checkout is the only action; the runner's installed stable Cargo avoids installing the SDK build toolchain in PR CI. The check name and PR/main triggers stay intact.

Moved

• Action pinning, whitespace, JSON parsing and JavaScript syntax checks into the existing SDK release qualification policy lane. JSON/syntax checks now cover the tracked tree when qualifying a release.
• Rust formatting, actionlint, runner-boundary and compatibility-digest checks already run in qualification and remain there without duplicate invocations.
• Heavy qualification and generator workflows now accept only release callers, removing their independent manual launchers. The SDK has no ops/ci, IaC/tofu checks, Windows-path guard or release-qualification.yml; qualification.yml is its existing release qualification workflow.

Deleted

• PR Node setup, token-bearing diff fetching, diff-base fallback, conditional rustfmt/toolchain installer, unused IaC output, formatting selector and its dead test.
• The unreferenced standalone native-mount qualification workflow: release already runs the same native-mount qualification through release-acyclic.yml.

Decisions

• Per the user's clarification, no Cloud Python/Fleet policy guards were added to SDK, and arena is untouched.

Validation and new PR CI time

• Touched SDK CI tests: 11 passed (10 on the initial run; corrected one new assertion's regex and reran that assertion only). Includes real Cargo regressions for missing lockfile, changed package version and new dependency, plus unchanged-lock preservation.
• Real repository lock gate: 5.7 s with an empty Cargo cache; 0.6 s warm. No compilation or dependency-source downloads. GitHub required SDK Static job passed in 7 seconds (2026-10-12 21:21:11–21:21:18 UTC), run 38310086648.
• Workflow runner guard, touched Node syntax checks, shell syntax and PR whitespace checks passed.
• Full multi-platform release qualification was not run; no Rust crate was changed.

Review fixes

• Updated docs/ci-releases.md to describe the lock-only required job and diagnostics through release.yml with publish=false; removed the deleted manual trigger instructions.
• Release whitespace now checks the complete range from the previous ancestor acyclic-v* release tag (the tracked tree for the first release). A tag at HEAD cannot hide the range on publication retries. Only the policy lane fetches full history and tags.
• Four focused regressions pass: an earlier-commit whitespace error with a tag at HEAD, inherited whitespace outside the release range, first-release tree checking, and workflow/docs wiring.

Release cleanup

• The corrected full-range checker now exposes pre-existing whitespace since acyclic-v0.1.5 in patches/napi-rs-cli-3.10.5.patch, harness-codex help fixtures, scripts/fixtures/native-build-inputs.mjs, scripts/test-plan-qualification.mjs, the Swift fixture package.mjs, generated Actors ErrorMetadata.ts, and the Stream grpc-provider-conformance.mjs fixture. Release policy fails on these existing errors; this PR leaves unrelated fixtures and generated output unchanged. The PR diff itself is whitespace-clean.

Live steps

• None. Coordinator merges this main-based PR.

🤖 Generated with Claude Code

---

Summary by cubic

The required SDK Static PR check now only validates Cargo manifest/lockfile consistency with cargo update --workspace --locked, so it no longer compiles crates or needs Node setup, token-backed diff fetching, or the SDK toolchain. The remaining static checks move into the release qualification lane, and heavy workflows are now reachable only through the release caller.

• Removes manual workflow_dispatch triggers from qualification, generator, and agent-host workflows, and deletes the unreferenced standalone native-mount qualification workflow; release already runs native mount via release-acyclic.yml.
• Release whitespace now checks the complete range from the previous acyclic-v* release tag (the tracked tree for the first release), so errors in earlier commits can't hide behind a tag at HEAD. Only the policy lane fetches full history and tags.
• Adds regression tests covering the lockfile check (unchanged locks, missing locks, changed versions, new dependencies) and the release whitespace range scenarios.
• Updates docs/ci-releases.md for the lock-only required job and diagnostics via SDK Release with publish=false.