CI: enforce local warning gates and bound model preparation correctly

[andersalm]

The local pre-push gate now refuses the warning and lint failures that CI refuses. It uses the CI Rust flags, checks reverse consumers, and runs release self-tests when their inputs change. Documentation and generic CI helper changes keep the basic checks without cleaning and rebuilding unrelated Rust workspaces; embedded documentation and product inputs still select their consumers.

The installed Home journey also uses its existing model-preparation window for the first engine refusal. Get returns before preparation finishes. Run 37943218922 failed while the model download was still in progress, and the Linux retry consumed another 41 minutes. The Retry deadline and journey assertions stay in place.

Validation:

• Push hook passed for candidate 6d6330e4a414dcb0dbe5b35b828fb6f94e05468d, tree 4923852246b10d6f59c6d54fd4df917a9ae941d2, against develop 7184e044.
• All 65 local-gate fixtures and 102 product-data tests passed; both required Rust formatting gates and diff checks passed.
• Independent agent review approved the complete diff, SHA-256 f042484ebbea0ae0c29d3889b448bbcfa7c7176df41db518699bd060bc01e82b.
• The changed scripts have no Rust build consumer, so this local run selected no Cargo compilation.

Refs #319 and #194.

Hosted CI passed on 6d6330e4a414dcb0dbe5b35b828fb6f94e05468d: run 37973992785, first attempt, 11 successful jobs. All three installed platform journeys passed. Total elapsed time: 71m01s. Accepted integration remains open in #319.

Different-model adversarial review passed on exact candidate 6d6330e: #326 (comment). Development review, local checks and the 11-job hosted CI run have passed. Review rule (Anders, 10 Oct, #89): for install/update, independent model reviews replace the pending human reviews. Remaining: current-base acceptance and integration into develop (alpha.15 train). Wider policy-input coverage is tracked in #317.

Develop advanced to 37e58ea through #327 after this PR's successful CI run. Its17 changed paths and this PR's3 paths are disjoint; Git computes a clean combined tree f12334311107922fa8ab85e89b1a33364ea179ba. The current head, reviewed source files and 11-job CI evidence remain6d6330e4. That hosted run tested the earlier7184 base; this clean merge calculation is compatibility evidence, and current combined installed acceptance remains an integration check. Keeping the passed candidate avoids launching another full matrix solely to change ancestry while private compatibility work is active.

[andersalm]

Independent development review (Codex agents), exact head 6d6330e4a414dcb0dbe5b35b828fb6f94e05468d.

VERDICT: PASS

Author-independent review covers the complete three-file change: CI warning parity, reverse-consumer scope, release self-tests and the existing model preparation window. All journey assertions and Retry behavior remain in place. Local fixtures and full hosted CI passed on this exact head. Anders accepts integration.

Reviewed diff SHA-256: f042484ebbea0ae0c29d3889b448bbcfa7c7176df41db518699bd060bc01e82b.

[andersalm]

Independent adversarial review (Claude Opus via existing reviewer runtime), exact head 6d6330e.

VERDICT: PASS

Blocking findings: none.

• Warning flags: At scripts/ci-local-prepush.py:27-34, every cargo child loses CARGO_ENCODED_RUSTFLAGS and gets RUSTFLAGS=-D warnings. This matches ci.yml:28. Cargo uses only the highest-priority rustflags source, so RUSTFLAGS also overrides CARGO_BUILD_RUSTFLAGS, CARGO_TARGET_*_RUSTFLAGS and config-file rustflags. cargo check --workspace --all-targets now refuses warnings in every member of each workspace it checks.
• Reverse consumers (:353-378): The edges come from metadata --no-deps dependencies[].path, which lists normal, dev, build, optional and target-specific declarations. No [patch] or [replace] section exists in any Cargo.toml, so no hidden edge is missed. Dependent crates in the Runtime and in capsule workspaces get -p Clippy; unit tests keep their direct-input scope (:388-400).
• Zero cases and children: The zero-test refusals in crate_units are unchanged. The release self-tests go through run(), so they keep the existing process-group cleanup and a non-zero exit becomes GateError.
• Journey timing: --home-only is never combined with --carrier-get (ci-installed-journeys.py:475). The first refusal therefore waits at most readyMs = 180 s (ci-installed-home-journey.mjs:15,110). The Retry wait (90 s) and all assertions are unchanged.
• Embedded docs: Skipping .md/.txt is safe for the four include_*!(concat!(env!("CARGO_MANIFEST_DIR"), "/../…")) sites in elastos-server. The /../ handling in referenced_inputs resolves them.

Non-blocking notes:

1. Release trigger is narrow: The trigger at :534-535 matches the issue's Done means literally, but the inputs of ci-release-policy-test.py are mostly different files. It reads .github/workflows/ci.yml, release-package.yml, .github/actions/rust-compile-cache/action.yml, package-release-binaries.sh, ci-installed-journeys.{py,sh} and build-llama-server-bundle.sh. A change to any of these, or to scripts/ci-release-policy-test.py itself, skips the test locally. The source-gate tests prepare-release-platform-test.py and publish-platform-artifacts-test.py never run locally.
2. Other environment overrides: The gate does not reset RUSTC_WRAPPER, RUSTC_WORKSPACE_WRAPPER, RUSTC or CARGO_BUILD_TARGET. A caller wrapper could still cap lints, or a different target could change which code is checked. CI still refuses the result.
3. Doc and tooling changes: These no longer compile the Runtime. That is safe only while embedded inputs are written as literal paths. Doctests in an included README were never run locally (existing gap).

Not checked: I ran no gate, fixture or cargo command, and I made no network calls. The rustflags priority order and the dependency kinds that cargo metadata reports come from the Cargo documentation, not from a run here. The 180 s window is enough on hosted runners only on the evidence of one run (37973992785), which I did not inspect. Behaviour in CI on other runners is [INFERENCE].