chore(ci): give browser proof headroom with fresh weights, a 20-minute bound and three shards

[schlessera]

Closes #2414

What changed

Browser proof gets more buffer three ways, per the maintainer's direction on #2414:

• Refreshed weights. scripts/browser-shard-costs.json browser measurements now come from successful main run 39109891338, attempt 1 (7f22bb6ac, which includes the test(ui-react): separate narrow callout geometry and capture #2393 split), via bun scripts/refresh-browser-costs.ts 39109891338 1 browser. Layout costs and provenance are untouched.

• 20-minute browser job bound (was 15), pinned by tests/ci-workflows.test.ts. Layout stays at 25.

• Three browser shards (layout stays two). One table, PROOF_SHARDS in scripts/proof-shards.ts, now feeds:

  • retention: scripts/proof-reuse.ts receipt divisor, source job count, per-shard validation and pair lookup;
  • the weight refresh (scripts/refresh-browser-costs.ts);
  • the inclusion partition fingerprint (scripts/inclusion-inputs.ts);
  • a new workflow guard (scripts/check-ci-workflows.ts) that matches each domain's ci.yml matrix and --shard divisor.

  scripts/ci-proof.ts and scripts/browser-sequencer.ts already parse any --shard=M/N and are unchanged.

Why

Browser (2) drifted from #2366's 840 s bar to 887 s on main and 917 s cancelled on a ready PR. The weights-only refresh in this PR's first confirmation (run 39111465321) measured 845 s and 730 s. That is better, but still above the bar.

Scored by fresh weights, each shard's slowest project:

Shards	Shard 1	Shard 2	Shard 3
2, old weights	564 s	628 s	—
2, refreshed	573 s	573 s	—
3, refreshed	482 s	482 s	482 s

That 482 s floor is navigation-reach.pointer.tsx in one rail project, the single heaviest file. A fourth shard gives nothing more. Splitting that file is the next lever and is out of scope here.

Validation

• bun run check:pr --base origin/main at d4cc90500 on 268b76ba6: 957 fast and 233 affected tests, all passing. Strict types pass.

• Retention: a two-shard-era receipt ("shard":"1/2") is refused for browser (tests/proof-reuse.test.ts). Fixtures now derive their job and receipt counts from PROOF_SHARDS.

• Refresh: browser measurements record every configured shard's job (tests/refresh-browser-costs.test.ts).

• Guard controls (tests/ci-workflows.test.ts): a browser matrix of [1, 2], a browser /2 divisor, a layout /3 divisor and a layout [1, 2, 3] matrix are each rejected.

• Mutation receipts, each restored byte-identically:

  Mutation	Fails at
  Guard fail removed	tests/ci-workflows.test.ts:354
  Guard skips the layout matrix only	tests/ci-workflows.test.ts:359

• Independent gpt-6-astra review: it verified retention integrity (three distinct jobs, exact M/3 receipts, partitions inside the fingerprint) and found the three-shard partition covers all 309 specs exactly once. Affected-only PRs still select whole domains, so no shard can be empty. Its two P3 findings are fixed: the missing layout-matrix control, and stale "two measured partitions" text in the decision record.

Gaps

• scripts/visual.mjs keeps a "both CI shards" comment and a --shard=1/2 usage example. The file is hash-pinned by the browser command activation audit, so I left it unchanged.
• scripts/browser-worker-audit.json describes its historical two-shard scope as recorded audit evidence.
• The ci.yml job-name/matrix change drifts it from the audited generated-CSS producer set. As with fix(ci): keep draft-mode success from standing as a ready PR's proof #2398, that binding falls back to fresh proof until a re-audit (ci: establish post-merge re-audit procedure for generated-CSS producers #2408).

No changeset: no shipped package files changed.

🤖 Generated with Claude Code