chore(ci): rebuild & harden workflows

[tomtastisch]

Phase-based CI workflow hardening with required-context contract preservation, version-policy deconfliction validation, qodana stabilization, artifact-contract expansion, and SSCC error UX integration.

[Copilot]

Pull request overview

This PR hardens the repository’s CI contract by expanding artifact enforcement to additional checks, standardizing workflow execution shells, stabilizing Qodana configuration/outputs, and adding a structured “error UX” diagnostic artifact for failed checks.

Changes:

• Expand the artifact contract policy to cover additional CI check IDs (api-contract/pack/consumer-smoke/package-backed-tests).
• Add failure-time “error UX” rendering that emits diag.json and prints a standardized error code + artifact link.
• Harden GitHub Actions workflows (bash default shell, set -euo pipefail in run steps) and adjust Qodana configuration/excludes.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tools/ci/policies/rules/artifact_contract.yaml	Updates artifact contract coverage by expanding the enforced check list.
tools/ci/lib/result.sh	Adds diag.json artifact + error UX emission/mapping logic on failures.
tools/ci/lib/error_ux.py	New renderer that maps failures to standardized error codes/messages and writes diag.json.
tools/ci/errors/steps.toml	Defines step → 2-digit IDs used to build error codes.
tools/ci/errors/classes.toml	Defines class → 2-digit IDs used to build error codes.
tools/ci/errors/errors.toml	Defines error code → message templates.
tools/ci/bin/run.sh	Routes summary/artifact_contract through PolicyRunner bridge and adds policy-contract runner helper.
qodana.yaml	Fixes indentation and adds scoped excludes for known false positives.
.github/workflows/qodana.yml	Always uploads artifacts and always runs the contract entry check.
.github/workflows/ci.yml	Sets bash as default shell and hardens run steps with set -euo pipefail.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

tools/ci/policies/rules/artifact_contract.yaml:30

• result.sh now always creates diag.json and includes it in the artifacts list in result.json, but the artifact contract rule doesn’t require diag.json. Adding it to required_artifacts would prevent regressions where the error UX output silently disappears.

      required_artifacts:
        - raw.log
        - summary.md
        - result.json

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 16 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

tools/ci/policies/rules/artifact_contract.yaml:29

• diag.json is now part of the documented result artifact set (and ci_result_init always creates it), but the artifact contract policy rule still only requires raw.log, summary.md, and result.json. To keep enforcement consistent with the updated contract, add diag.json to required_artifacts (or adjust the docs/implementation if diag.json is intended to be optional).

      required_artifacts:
        - raw.log
        - summary.md
        - result.json

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.