ci: one CI path — .hanzo/workflows

Both jobs in .github/workflows/ci.yml named `runs-on: lux-build-amd64`. No
runner on this forge carries that label — the pools are
`lux-build-linux-<arch>` — and a job naming a label nothing carries does not
fail, it waits. Every push to this repo left two jobs queued permanently.

The work itself was worth keeping, so build/vet/test and govulncheck move to
.hanzo/workflows/ci.yml on `lux-build-linux-amd64`, with a concurrency group so
a newer commit cancels the older run instead of queueing behind it.

govulncheck keeps its `|| true`. It reports without gating; making it blocking
is a policy decision, not part of moving where the job runs.

ci.yml was the whole of .github/workflows, so nothing is stranded — which is
the constraint that shapes this migration: the forge stops at the first
workflow directory that exists, so a repo's entire .github/workflows suite
goes dark the moment .hanzo/workflows appears.

Co-authored-by: Hanzo Dev <[email protected]>

.github/workflows/ci.yml

@@ -1,45 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main, dev]
-    tags: ['v*']
-  pull_request:
-    branches: [main, dev]
-
-permissions:
-  contents: read
-
-env:
-  GOWORK: off
-
-jobs:
-  test:
-    name: Build + Test (linux/arm64 + linux/amd64 stub)
-    runs-on: lux-build-amd64
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-          cache-dependency-path: go.sum
-
-      - name: Build
-        run: go build ./...
-
-      - name: Test (short)
-        run: go test -count=1 -short -timeout 300s ./...
-
-      - name: Vet
-        run: go vet ./...
-
-  govulncheck:
-    name: govulncheck
-    runs-on: lux-build-amd64
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-      - run: go install golang.org/x/vuln/cmd/govulncheck@latest
-      - run: govulncheck ./... || true

.hanzo/workflows/ci.yml

@@ -0,0 +1,56 @@
+name: CI
+
+# Build, vet and test on the native runners (git.hanzo.ai → git-runner).
+#
+# This replaces .github/workflows/ci.yml, whose two jobs named
+# `runs-on: lux-build-amd64`. No runner on this forge carries that label — the
+# pools are `lux-build-linux-<arch>` — and a job naming a label nothing carries
+# does not fail, it waits. Every push left two such jobs queued.
+#
+# So the rule here is that every job names a label the fleet actually carries.
+
+on:
+  push:
+    branches: [main, dev]
+    tags: ['v*']
+  pull_request:
+    branches: [main, dev]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# A newer commit makes the older run irrelevant.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  GOWORK: off
+
+jobs:
+  test:
+    runs-on: [lux-build-linux-amd64]
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+      - run: go build ./...
+      - run: go vet ./...
+      - run: go test -count=1 -short -timeout 300s ./...
+
+  govulncheck:
+    runs-on: [lux-build-linux-amd64]
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - run: go install golang.org/x/vuln/cmd/govulncheck@latest
+      # Advisory: reports findings without gating the merge. Kept as it was —
+      # turning it blocking is a policy decision, not a migration.
+      - run: govulncheck ./... || true