fix: prevent hanging tests and optimize CI builds

[HelloThisWorld]

Summary

Prevent Debug TAEF suites from hanging for hours and make native validation an explicit, label-gated operation. The Release delivery path now builds the package-capable source graph once and reuses it for compiled tests, unpackaged staging, Setup, Portable, lifecycle tests, and downloadable artifacts.

Related issues

N/A

Detailed changes

Debug hang root cause and code fix

The non-terminating executable was the shared TAEF runner for unitControl loading Control.Unit.Tests.dll. CommandTimelineTests::NativeOscLifecycleFeedsPaneTimeline resized a test-owned ControlCore without opting into its synchronous unit-test notification path. The resize queued a throttled scrollbar callback on a UI dispatcher that TAEF does not pump, and Debug teardown could wait indefinitely for that pending callback.

The prior Command Timeline fix sets ControlCore::_inUnitTests before initialization. This PR makes teardown deterministic as well: a scope guard always calls Close() and releases the core, mock connection, settings, renderer, terminal state, event revokers, and WinRT references before TAEF advances or unloads the module.

Bounded compiled tests and diagnostics

scripts/winterm/test.ps1 now launches the exact TAEF runner for each Relevant suite independently:

• unitSettingsModel: isolated bin\x64\<Configuration>\UnitTests_SettingsModel\te.exe
• terminalApp: repository TAEF plus Terminal.App.Unit.Tests.dll
• unitControl: repository TAEF plus Control.Unit.Tests.dll

Each suite has a 20-minute process timeout. Timeout handling terminates the runner and all descendants, returns failure, and records configuration, suite, executable, binary, command, timestamps, timeout, status, and exit code. Stdout, stderr, and diagnostic files are uploaded with if: always().

Workflow structure

Previous delivery validation built both Debug and Release, then checked out the repository in a separate package job and rebuilt the Release package graph through build-unpackaged.ps1.

The new modes are:

• No label: classification plus quick source, smoke, shell, layout, and workspace checks only.
• build: one package-capable x64 Release build, Release compiled tests, unpackaged/Setup/Portable creation, lifecycle tests, and downloadable artifacts. Debug is skipped.
• delivery: everything in build, plus x64 Debug build/tests in parallel with Release delivery.
• ci:full: compatibility alias for delivery.

Manual quick, build, and delivery modes are available; legacy fast and full map to build and delivery. The final ci-gate rejects failed, cancelled, missing, or unexpectedly executed jobs.

The Release job calls build.ps1 -GeneratePackage -IncludeTests once, then calls build-unpackaged.ps1 -SkipBuild; installer and portable builders also reuse that stage with -SkipBuild.

Build performance and safety

The package/WinMD/shared-PDB dependency graph remains serialized with /m:1. The solution-level restore performed by the package build is reused, while the three independent test projects build sequentially as projects with normal MSBuild /m support and no per-project /restore.

Job limits are 20 minutes for quick validation, 120 minutes for Debug, 120 minutes for Release delivery, 20 minutes per compiled suite, and 5 minutes for the final gate.

Validation performed

Passed locally:

• PowerShell parser validation for every modified script/module.
• PyYAML parsing of .github/workflows/winterm-validation.yml.
• powershell.exe -NoProfile -ExecutionPolicy Bypass -File scripts/winterm/test-ci-classification.ps1.
• powershell.exe -NoProfile -ExecutionPolicy Bypass -File scripts/winterm/test-release-workflow.ps1.
• x64 Debug and Release Control.UnitTests.vcxproj builds with MSBuild /m.
• Debug and Release Relevant runs through the new bounded runner; all six suite/configuration diagnostics reported Status=passed and ExitCode=0.
• Command Timeline integration coverage completed resize, snapshot, view-state, close, and teardown checks in both configurations.
• Smoke validation, layout fixture validation, and workspace benchmark.
• git diff --check.

Local limitations:

• The local antivirus blocked the pre-existing Compatibility.ps1 during the standalone shell-integration invocation with ScriptContainedMaliciousContent; no security policy was bypassed. The same shell-integration step passed in every GitHub Actions Quick job.
• A supplemental full local Debug graph completed the serialized package graph and reached the new parallel SettingsModel test-project phase, but the outer local command was intentionally capped at 30 minutes because of host resource pressure. Targeted Debug/Release builds passed, and the complete clean-run pipeline passed in GitHub Actions.

GitHub Actions verification:

• No-label run 30734407808: success; Quick and ci-gate ran, while Debug and Release were skipped.
• build run 30733431814: success; one Release delivery graph ran, Debug was skipped, lifecycle tests passed, and Release diagnostics plus the distribution artifact were uploaded.
• delivery run 30734447222: success; Debug and Release started in parallel at 05:38:10Z, Debug completed in 22m34s, its three bounded suites completed in 38 seconds, Release completed in 29m02s, and the final gate passed.
• The delivery run uploaded non-expired winTerm-x64-Debug-compiled-test-diagnostics, winTerm-x64-Release-compiled-test-diagnostics, and winTerm-1.2.1-x64-distributions artifacts. The distribution artifact was downloaded and verified to contain winTerm-1.2.1-setup-x64.exe and winTerm-1.2.1-portable-x64.zip.
• Earlier build run 30732852166 was automatically cancelled when the PR changed from draft to ready-for-review and its replacement run started; its cancelled gate was expected and is superseded by the successful runs above.

Checklist

• The change is focused and does not include unrelated formatting.
• Tests were added or updated where appropriate.
• All tests claimed above actually ran and passed.
• User-facing behavior and limitations are documented in this repository.
• Version or schema changes include compatibility and migration notes.
• Package identity, winterm.exe, and Microsoft Terminal coexistence remain isolated.
• No command text, terminal output, clipboard content, credentials, or private paths are logged.
• New source and script files contain the appropriate MIT license header.
• I did not include generated build output, secrets, certificates, or local absolute paths.