Port upstream runtime while preserving Boat staging migration history

.github/workflows/pr-trusted.yml

@@ -502,6 +502,15 @@ jobs:
           # across three dedicated runners (~143s each), and the remaining
           # ~2755s levels across twelve duration-balanced shards at ~230s
           # each, in line with the other ~200-290s lanes.
+          #
+          # The balance only holds while the manifest is fresh. By 2026-10-10
+          # the without-chat group had grown to 871 suites and ~5031s of serial
+          # vitest time (mean of runs 38076844891 and 38076972444), 230 of
+          # them unrecorded and weighted at the median, so the twelve shards
+          # ran 313-554s of tests (server 2/12 at 618s was the slowest check
+          # in the run). Re-recorded durations level them to ~415s each; the
+          # shard count stays at twelve because Build and workspaces-b sit
+          # above that already.
           - group: general-server-without-chat
             group_label: server (1/12)
             shard_index: 0

.github/workflows/release.yml

@@ -361,6 +361,25 @@ jobs:
           ref: ${{ github.sha }}
           fetch-depth: 0
 
+      - name: Attach verified canary source to local master
+        env:
+          SOURCE_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          if [ "$GITHUB_REPOSITORY" != "paperclipai/paperclip" ] ||
+             [ "$GITHUB_EVENT_NAME" != "push" ] ||
+             [ "$GITHUB_REF" != "refs/heads/master" ]; then
+            echo "Error: canary branch attachment requires a trusted master push." >&2
+            exit 1
+          fi
+          if ! [[ "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]] ||
+             [ "$(git rev-parse HEAD)" != "$SOURCE_SHA" ]; then
+            echo "Error: canary checkout does not match the pinned source SHA." >&2
+            exit 1
+          fi
+          git checkout -B master "$SOURCE_SHA"
+          test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
+
       - name: Setup pnpm
         uses: pnpm/action-setup@v6
         with: