ci: add serial cross-platform reference runs

.github/workflows/ci.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches: [main, master]
   pull_request:
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -17,9 +18,9 @@ env:
 
 jobs:
   node-24:
+    if: github.event_name != 'workflow_dispatch'
     runs-on: ubuntu-latest
     name: node 24 / ${{ matrix.lane }}
-    timeout-minutes: 1
     env:
       DSH_GATE_CONCURRENCY: ${{ matrix.gate_concurrency }}
       DSH_PUBLINT_CONCURRENCY: ${{ matrix.publint_concurrency }}
@@ -248,9 +249,9 @@ jobs:
         run: ${{ matrix.command }}
 
   node-compat:
+    if: github.event_name != 'workflow_dispatch'
     runs-on: ubuntu-latest
     name: node ${{ matrix.node }}
-    timeout-minutes: 1
     env:
       DSH_GATE_CONCURRENCY: '2'
       DSH_NODE_COMPAT_SKIP_TYPECHECK: ${{ matrix.skip_typecheck }}
@@ -292,9 +293,9 @@ jobs:
         run: pnpm run check:node-compat
 
   python-sdk:
+    if: github.event_name != 'workflow_dispatch'
     runs-on: ubuntu-latest
     name: python 3.10 / keyless SDK
-    timeout-minutes: 1
     steps:
       - uses: actions/checkout@v6
 
@@ -313,9 +314,9 @@ jobs:
   # while the broader observational gate matrix below exposes the remaining
   # portability work without blocking mainline merges.
   windows-build:
+    if: github.event_name != 'workflow_dispatch'
     runs-on: windows-2025
     name: windows / build
-    timeout-minutes: 3
     steps:
       - uses: actions/checkout@v6
 
@@ -341,10 +342,10 @@ jobs:
   # would change the environment being measured. This job intentionally stays
   # out of all-checks-passed.needs.
   windows-gates:
+    if: github.event_name != 'workflow_dispatch'
     continue-on-error: true
     runs-on: windows-2025
     name: windows node 24 / ${{ matrix.lane }}
-    timeout-minutes: 3
     env:
       DSH_GATE_CONCURRENCY: ${{ matrix.gate_concurrency }}
       DSH_PUBLINT_CONCURRENCY: ${{ matrix.publint_concurrency }}
@@ -433,6 +434,104 @@ jobs:
         shell: pwsh
         run: ${{ matrix.command }}
 
+  # Manual reference runs deliberately avoid the optimized matrices above.
+  # Each host executes the complete, unsharded primary Node aggregate with one
+  # gate worker, giving reviewers a simple cross-platform oracle for completeness
+  # and timing.
+  serial-linux:
+    if: github.event_name == 'workflow_dispatch'
+    name: serial / linux
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.PRIMARY_NODE_VERSION }}
+
+      - name: Enable corepack (pnpm)
+        run: corepack enable
+
+      - name: Install (immutable)
+        run: pnpm install --frozen-lockfile
+
+      - name: Install bubblewrap (unrestrict userns)
+        run: |
+          sudo apt-get update -q
+          sudo apt-get install -yq --no-install-recommends bubblewrap
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 \
+            || echo "apparmor userns knob absent — the functional probe decides"
+
+      - name: Run complete unsharded primary Node CI serially
+        env:
+          DSH_COVERAGE_MAX_WORKERS: '1'
+          DSH_E2E_MAX_WORKERS: '1'
+          DSH_GATE_CONCURRENCY: '1'
+          DSH_PUBLINT_CONCURRENCY: '1'
+          DSH_SNAPSHOT_MAX_CONCURRENCY: '1'
+        run: pnpm run check:ci
+
+  serial-macos:
+    if: github.event_name == 'workflow_dispatch'
+    name: serial / macos
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.PRIMARY_NODE_VERSION }}
+
+      - name: Enable corepack (pnpm)
+        run: corepack enable
+
+      - name: Install (immutable)
+        run: pnpm install --frozen-lockfile
+
+      - name: Run complete unsharded primary Node CI serially
+        env:
+          DSH_COVERAGE_MAX_WORKERS: '1'
+          DSH_E2E_MAX_WORKERS: '1'
+          DSH_GATE_CONCURRENCY: '1'
+          DSH_PUBLINT_CONCURRENCY: '1'
+          DSH_SNAPSHOT_MAX_CONCURRENCY: '1'
+        run: pnpm run check:ci
+
+  serial-windows:
+    if: github.event_name == 'workflow_dispatch'
+    name: serial / windows
+    runs-on: windows-2025
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Enable Developer Mode (symlink support)
+        shell: pwsh
+        run: >-
+          reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock"
+          /t REG_DWORD /f /v "AllowDevelopmentWithoutDevLicense" /d "1"
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.PRIMARY_NODE_VERSION }}
+
+      - name: Enable corepack (pnpm)
+        shell: pwsh
+        run: corepack enable
+
+      - name: Install (immutable)
+        shell: pwsh
+        run: pnpm install --frozen-lockfile
+
+      - name: Run complete unsharded primary Node CI serially
+        shell: pwsh
+        env:
+          DSH_COVERAGE_MAX_WORKERS: '1'
+          DSH_E2E_MAX_WORKERS: '1'
+          DSH_GATE_CONCURRENCY: '1'
+          DSH_PUBLINT_CONCURRENCY: '1'
+          DSH_SNAPSHOT_MAX_CONCURRENCY: '1'
+        run: pnpm run check:ci
+
   # Single stable required check for branch protection: require "all checks
   # passed" instead of enumerating matrix legs whose names change as lanes and
   # node versions evolve. Every blocking job in THIS workflow must be listed in
@@ -445,9 +544,8 @@ jobs:
   all-checks-passed:
     name: all checks passed
     runs-on: ubuntu-latest
-    timeout-minutes: 1
     needs: [node-24, node-compat, python-sdk, windows-build]
-    if: always()
+    if: always() && github.event_name != 'workflow_dispatch'
     steps:
       - name: Fail if any needed job did not succeed
         if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')