Merge frozen master into work-folders base

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/docker-runner-check.yml

@@ -6,6 +6,7 @@ on:
       - .github/workflows/docker-runner-check.yml
       - Dockerfile
       - .dockerignore
+      - scripts/check-docker-runner-cache.sh
       - packages/paperclip-runner/rust-toolchain.toml
       - packages/paperclip-runner/runner/**
       - packages/paperclip-runner/protocol/**
@@ -20,7 +21,7 @@ jobs:
   runner:
     name: Compile isolated native Runner
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 20
     permissions:
       contents: read
     steps:
@@ -30,8 +31,8 @@ jobs:
           persist-credentials: false
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
-      # Compile the real target with the real .dockerignore. This catches new
-      # Cargo or embedded protocol inputs that the isolated COPY set omits.
-      # No registry credentials, cache imports/exports, or image publication.
-      - name: Compile the Runner from its isolated Docker context
-        run: docker buildx build --target runner-build --progress plain .
+      # Compile the real target, then change source in a disposable context.
+      # Require dependency-layer reuse and changed metadata from the real binary.
+      # No registry credentials, external cache, or image publication.
+      - name: Verify native build and dependency cache reuse
+        run: bash scripts/check-docker-runner-cache.sh

.github/workflows/release-verify.yml

@@ -262,12 +262,21 @@ jobs:
         run: pnpm test:runner-workflow-evals
 
   verify_paperclip_runner:
-    name: Verify Paperclip Runner
+    name: Verify Paperclip Runner (${{ matrix.lane }})
     runs-on: ${{ vars.AWS_POST_MERGE_CI_ENABLED == 'true' && github.repository == 'paperclipai/paperclip' && github.repository_id == '1170821064' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.sha != '' && inputs.ref == github.sha && 'runs-on/fleet=paperclip-post-merge-x64/env=public-ci' || 'ubuntu-latest' }}
     timeout-minutes: 20
     permissions:
       contents: read
 
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - lane: protocol
+            checks: check:eval-kernel check:protocol
+          - lane: rust
+            checks: check:runner check:api-authority
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -305,15 +314,27 @@ jobs:
           # dependencies; never restore installed executables from cargo/bin.
           cache-workspace-crates: false
           cache-bin: false
-          # The step guard also restricts restores. Save only after a successful
-          # master-push verification of that push's exact commit.
-          save-if: ${{ github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ref == github.sha }}
+          # Both lanes restore the existing dependency cache. Only the Rust
+          # lane saves it, after warming both release and debug dependencies.
+          save-if: ${{ matrix.lane == 'rust' && github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ref == github.sha }}
 
       - name: Install dependencies
         run: pnpm install --no-frozen-lockfile
 
       - name: Verify Paperclip Runner
-        run: pnpm --filter @paperclipai/paperclip-runner check:all
+        env:
+          RUNNER_CHECKS: ${{ matrix.checks }}
+        run: |
+          set -euo pipefail
+          for check in $RUNNER_CHECKS; do
+            pnpm --filter @paperclipai/paperclip-runner "$check"
+          done
+
+      - name: Warm debug dependencies for the shared Runner cache
+        # Protocol tests need debug binaries. Populate their dependencies in
+        # the sole cache writer, so a cold save also serves the protocol lane.
+        if: ${{ matrix.lane == 'rust' && github.repository == 'paperclipai/paperclip' && github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.ref == github.sha }}
+        run: pnpm --filter @paperclipai/paperclip-runner build:rust
 
   build:
     name: Build