run on the native fleet

Adds .hanzo/workflows/cicd.yml calling the canonical pipeline and drops the
GitHub-hosted workflows it replaces. Lands here because this is where the repo
is written — git.hanzo.ai is upstream and github.com is its push mirror, so the
same change made on github.com never reaches the runner fleet.

.github/workflows/ci.yml

@@ -1,86 +0,0 @@
-name: CI Checks
-on:
-  push:
-  pull_request:
-  workflow_dispatch:
-jobs:
-  checks:
-    name: Run static checks
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 1
-    - name: Setup Go
-      uses: actions/setup-go@v5
-      with:
-        go-version: '1.26.3'
-
-    - uses: actions/cache@v4
-      with:
-        path: ~/go/pkg/mod
-        key: ${{ runner.os }}-go-tools-${{ hashFiles('**/go.sum') }}
-        restore-keys: |
-          ${{ runner.os }}-go-tools
-
-    - name: Setup tools
-      run: make get_tools
-
-    - name: Run Makefile checks
-      run: make checks
-
-  tests:
-    name: Run Go ${{ matrix.go }} tests
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        go: ['1.26.3']
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ${{ matrix.go }}
-
-      - uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cache/go-build
-            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ matrix.go }}-build-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-${{ matrix.go }}-build-
-
-      - name: Build
-        run: go build ./...
-
-      - name: Run Makefile tests
-        run: make test
-
-  tests-simd:
-    name: Run SIMD NTT tests (GOEXPERIMENT=simd)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.26.3'
-
-      - uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cache/go-build
-            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-simd-build-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-simd-build-
-
-      - name: Build with SIMD
-        run: GOEXPERIMENT=simd go build ./...
-
-      - name: Test with SIMD
-        run: GOEXPERIMENT=simd go test -count=1 ./ring/ -v -run 'TestNTT|TestMRedLazy4|TestMul64x4|TestNTTSimd'

.github/workflows/docs.yml

@@ -1,66 +0,0 @@
-name: Deploy Docs to GitHub Pages
-
-on:
-  push:
-    branches: [main, master]
-    paths:
-      - 'docs/**'
-      - '*.go'
-      - 'README.md'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
-concurrency:
-  group: pages
-  cancel-in-progress: false
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: docs
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-          cache: 'pnpm'
-          cache-dependency-path: docs/pnpm-lock.yaml
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Build docs
-        run: pnpm build
-
-      - name: Setup Pages
-        uses: actions/configure-pages@v5
-
-      - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
-        with:
-          path: docs/out
-
-  deploy:
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
-    needs: build
-    steps:
-      - name: Deploy to GitHub Pages
-        id: deployment
-        uses: actions/deploy-pages@v4

.hanzo/workflows/cicd.yml

@@ -0,0 +1,13 @@
+# Canonical caller — every knob lives in /hanzo.yml, none here.
+# Runs on the git-runner fleet at git.hanzo.ai, the only pool serving these
+# labels; github.com has no runner for them.
+name: CI/CD
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+jobs:
+  cicd:
+    uses: hanzoai/ci/.hanzo/workflows/build.yml@v1
+    secrets: inherit

hanzo.yml

@@ -0,0 +1,16 @@
+# Native CI for luxfi/lattice, on the git.hanzo.ai runner fleet.
+#
+# No images: this is a library. What it ships is the module itself, so the
+# whole pipeline is the gate below.
+test:
+  - name: build
+    run: |
+      set -e
+      go build ./...
+  - name: unit
+    # The whole tree rather than a named list, so a package added later is
+    # covered without editing this file. 46 packages, ~25s from cold.
+    # `make test` is this same command with the test cache cleared first.
+    run: |
+      set -e
+      go test ./... -count=1