feat(ci): source-bound Linux proofs through bosn and act2 #1635

Context

Fbuild has no local-gate.toml, root ci-attestations.yml, or source-bound bosn CI proof. Ordinary PRs enter generated ci-minimal.yml. Its linux reusable call runs both check (workspace Clippy, subprocess/USB guards and workspace tests) and python-facade-tests (the separately invoked ignored embedded-Python suite). Treating only the workspace test as a passing gate would omit required coverage.

The board planner selects changed-path board lanes and shares one fbuild binary between them. ci-test/ci-full select extended/full workflows; full coverage includes both macOS architectures, Windows, Dylint and the complete board matrix. Those behaviors must stay intact. ci/render_workflows.py owns generated entrypoints; existing reusable check-ubuntu.yml uses the promoted setup-soldr SHA d17a58eb2cea17a89af0824fb7c6b24ee68f5083 and distinct compiled-cache suffixes for its two jobs.

Proposal

Add a native Linux-x64 source-bound local gate that runs both reusable Ubuntu jobs through bosn's pinned act2 engine. Validate clean snapshot, exact SHA, workflow, selected job IDs, terminal success and native host/daemon architecture. Fail fast on malformed YAML and cheap CI-contract guards. Add typed per-gate attestations and a shadow verifier through the workflow generator. Keep remote jobs running initially; local proof does not attest board builds, full mode or other native hosts. Measure cold, fresh-engine warm and unchanged-tree reuse separately before promoting trust.

Acceptance criteria

• RED -> GREEN evidence for missing/stale/dirty/failed/partial proofs, including absence of the Python-facade job.
• Execute both existing Ubuntu jobs locally on a clean committed tree; prove the required commands and successful test results from engine evidence.
• Preserve changed-path board planning, extended/full selection, full coverage aggregation and all native/board/artifact commands.
• Modify generated workflow behavior through ci/render_workflows.py; generate no new .github/workflows files.
• Start in shadow mode; no remote skip from incomplete Linux-only proof.
• Record real local cache saves/restores, cold/warm durations and zero-engine identical-tree reuse.
• Run focused CI guards, generator drift checks, review and the declared local gate before pushing; full CI validates the migration candidate.

Decisions

• Both Ubuntu jobs belong to the first gate because the ignored Python tests are required existing coverage.
• Keep board/native/full proofs separate, with explicit limits in the attestation manifest.
• Use the shared promoted setup-soldr policy rather than add repository act-only cache workarounds.
• Proceed after kernal-api's successful cold/warm Dylint checkpoint; its Linux permission dependency is separately pending clarification of the owner's closure of act2 PR Add Serial/USB foot-gun warnings for AVR (ATmega32U4), RP2040, and Teensy #6.