ci: split behavior coverage between local validation and required CI

[ruby-dlee]

Intent

Update PR 323 onto current main including merged PR 325, then run the normal bounded validation path. Preserve the complete 123-file required-CI behavioral coverage union while keeping ordinary local validation at or below 15 minutes and local-plus-required-CI evidence at or below 30 minutes. Do not spend Azure budget, weaken any behavior family or seal, modify Crosscheck code/config/deployment, or merge the PR. The ordinary local path must remain the registry-derived serial herdr-lab/herdr-mixed set through tests/run.sh plus locked Agent Fleet pytest and compileall, while required GitHub Behavior tests retain the full eight-runner inventory including all hermetic bodies and the mixed-file hermetic portion.

What Changed

• Limit ordinary local validation to the registry-derived herdr-lab and herdr-mixed tests through one serial tests/run.sh invocation, followed by locked Agent Fleet pytest and compileall checks.
• Define required eight-runner CI as the owner of the complete behavior inventory while preserving the existing Azure-selected remote/local split.
• Update Azure runner coverage tests and documentation for the local-plus-required-CI coverage contract.

Risk Assessment

✅ Low: The change is narrowly scoped and preserves the required registry-derived serial local Herdr set, locked Agent Fleet checks, and the existing eight-runner required-CI coverage union without modifying Crosscheck or Azure deployment behavior.

Testing

The successful baseline exercised the normal local path; focused executable contracts then verified registry-derived serial Herdr selection, locked package commands, remote fail-closed behavior, and the complete disjoint 123-file eight-runner CI union. CLI logs provide reviewer-visible evidence; no screenshot was appropriate because this is a shell/CI workflow change.

Evidence: 123-file eight-shard inventory and timing plan

Target acceptance evidence
target_commit=e67ff0df9f26192999a0e75feaf55500100c3978
behavior_files=123
duration_rows=123
capability_rows=123
local_registry_selection=herdr-lab:9 herdr-mixed:1 hermetic-excluded:113
FM_BEHAVIOR_PLAN ok tests=123 shards=8
FM_BEHAVIOR_SHARD shard=1 tests=13 estimated_ms=513730
FM_BEHAVIOR_SHARD shard=2 tests=12 estimated_ms=513723
FM_BEHAVIOR_SHARD shard=3 tests=16 estimated_ms=513729
FM_BEHAVIOR_SHARD shard=4 tests=16 estimated_ms=513724
FM_BEHAVIOR_SHARD shard=5 tests=17 estimated_ms=513730
FM_BEHAVIOR_SHARD shard=6 tests=16 estimated_ms=513727
FM_BEHAVIOR_SHARD shard=7 tests=17 estimated_ms=513725
FM_BEHAVIOR_SHARD shard=8 tests=16 estimated_ms=513728

Evidence: Behavior shard execution and union contract

== tests/fm-behavior-shards.test.sh ==
ok - every behavior test is executable in the working tree and committed 100755
ok - checked-in LPT plan is deterministic, complete, disjoint, and duration-balanced
ok - coverage guard rejects missing and duplicate duration entries
ok - shard runner names tests, runs the full assignment, and preserves failures
ok - timing data is checked in and refreshable through the real runner
ok - post-run guard rejects missing, duplicate, and failed executions
ok - CI wires eight named isolated shards, a tight timeout, and executed-union verification
ok - teardown wrappers preserve all 147 normal cases and three focused-only cases

Evidence: Local registry-derived and remote split contract

== tests/fm-azure-runner.test.sh ==
ok - private controller has exact UAMI, no public ingress/SAS, isolated command, trusted post-command uploader, and safe cleanup order
ok - normal environment defaults to strict without commissioning evidence or confirmation variables
ok - runner gates main and control storage to disabled or one exact operator /32 rule
ok - prepare binds fresh public main and admits only an exact advertised branch or PR-head ref with bound ancestors
ok - private parent prepare binds one exact source ref/head/tree/bundle/blob without requiring an early push
ok - repository command receives no Azure/token/SAS/secret environment or inherited credential descriptor
ok - Linux systemd uid/capability integration is CI-owned
ok - local spend ledger reserves idempotently, excludes self, survives double cleanup, and fails closed on corruption
ok - foundation RBAC expansion stays effective-scope-complete and fails closed on unreadable output
ok - validation parent proof bounds child count and removes only the already-reserved shared meter
ok - Cost Management retry is bounded, honors both Azure guidance headers, and only permits a short exact authoritative cache
Traceback (most recent call last):
  File "<stdin>", line 13, in <module>
  File "/Users/dongkeun/.no-mistakes/worktrees/b174997b7206/01M0V100EP2SBC46DCJD643Z8A/bin/fm-azure-runner.py", line 1663, in retail_rate
    cache_path = env["state_dir"] / "retail-rate-cache.json"
                 ~~~^^^^^^^^^^^^^
KeyError: 'state_dir'
ok - retail pricing selects exact Linux on-demand consumption and refuses Low Priority or ambiguity
ok - quota snapshot binds exact regional/family limits and the deterministic pool spreads families
ok - runner queues behind the shared allocator and requires actual/forecast evidence before compute
ok - runner-local strict and commissioning defenses keep the budget-alert proof, itemized bound, and ledger concurrency
ok - the run-owned step log carries the verified Azure VM instance and boot identities beside the verdict
ok - the runner document owns the per-run file, HOME-owned environment admission, visible local path, and run-owned Azure proof
azure-runner: class=lint selected REMOTE resource-class=validation-standard source=FM_AZURE_RUNNER_REMOTE_CLASSES (dispatching)
azure-runner: class=lint selected REMOTE resource-class=validation-standard source=FM_AZURE_RUNNER_REMOTE_CLASSES (dispatching)
azure-runner: class=lint selected REMOTE resource-class=validation-standard source=FM_AZURE_RUNNER_REMOTE_CLASSES (dispatching)
azure-runner: class=lint executed LOCALLY (routing=absent, env=absent)
ok - the dispatch caller derives task/generation from the ambient run, passes the operator subscription through, and fails closed with exact refusals
azure-runner: class=test selected REMOTE resource-class=behavior-heavy source=FM_AZURE_RUNNER_REMOTE_CLASSES (dispatching)
ok - the real test step offloads the non-Herdr suite with derived ambient bindings and fails closed without host fallback
ok - per-run routing selects a class from a file the run can carry, an absent file stays local and says so, and every present-but-broken file refuses by name and runs the command nowhere
# fm-azure-runner.test.sh: all assertions passed

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• if [ "${FM_AZURE_VALIDATION_CELL:-0}" = 1 ]; then exec "$FM_AZURE_VALIDATION_SHARD_BRIDGE" behavior --count "${FM_AZURE_VALIDATION_SHARD_COUNT:-8}"; else exec bin/fm-no-mistakes-test-command.sh; fi
• Baseline configured command already completed successfully: if [ "${FM_AZURE_VALIDATION_CELL:-0}" = 1 ]; then exec "$FM_AZURE_VALIDATION_SHARD_BRIDGE" behavior --count "${FM_AZURE_VALIDATION_SHARD_COUNT:-8}"; else exec bin/fm-no-mistakes-test-command.sh; fi
• tests/run.sh "$PWD/tests/fm-behavior-shards.test.sh"
• tests/run.sh "$PWD/tests/fm-azure-runner.test.sh"
• bin/fm-behavior-shards.sh --check 8
• Compared executable behavior, duration, and capability inventories at target commit e67ff0df9f26192999a0e75feaf55500100c3978; each contains exactly 123 files/rows, with 9 herdr-lab, 1 herdr-mixed, and 113 hermetic entries.
• Checked the duration-balanced plan: the longest estimated required-CI shard is 513,730 ms (8.56 minutes), supporting the bounded local-plus-required-CI contract.

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.