ci: split the complete demo gate into parallel cached legs

The gate ran as one serial 30-minute job with no Cargo caching, so every
pull request recompiled the workspace roughly eight times over: the zigbuild
cross target, the workspace test build, a second full build under
clippy-driver, two feature-flip checks, a debug build, a release build for
the release-profile loopback, and release feature flips for demo-direct-node
and demo-auth-bypass. A documentation-only pull request paid the full thirty
minutes for checks it could not affect.

Ordering made it worse. The cross build ran first and `cargo fmt --check`
ran seventy lines later, so a missing newline cost a complete gate to learn
about.

verify-demo-build.sh is now the ordered union of named stages, and `--stage`
runs one. Passing no argument still runs every stage, so the release and
hardware-UAT workflows are unchanged. `--stage quick` is about five seconds.

CI runs those stages as parallel legs behind the required `Complete demo
gate` summary job, each restoring its own Cargo cache. The summary job fails
unless every leg succeeded or was a leg the audited docs-only scope may
skip; the lint and repository-test legs always run, which is what keeps the
website, docs, and README claim contracts covered on a docs-only diff.

verify_ci_cross_build_policy.py previously pinned the single job byte for
byte, which blocked speeding the gate up as effectively as it blocked
weakening it. It now asserts invariants instead: legs cannot suppress their
own failures, always-run legs carry no `if`, skippable legs carry exactly
the audited condition, the summary job depends on every other job so a new
job cannot be added outside the gate, the docs-only path allowlist is pinned
exactly, and no step can poison the toolchain. Its suite grows from 26 tests
to 51.

Structural checks cannot prove a stage still reaches a check, so
scripts/tests/demo-gate-stages.sh executes the real gate against stubbed
tools and asserts both that every check in a required inventory runs and
that the per-stage runs spend exactly the same commands as the default
complete run.

commit

8941f0b20bbeaecf6b7b87dfd1a84624325e3f99

parent

c9ba9802ae8027571a73f35c49b6763a6373f289

author

Dami <dami.etoile@gmail.com>