ci: add lean cargo-check tripwire on develop pushes (ENG-550)

[Andrew MacBride (amacbride)]

Summary

Closes ENG-550 (post-merge safety net portion).

Finding first: the pre-merge cargo-check gate ENG-550 asks for already exists — evaluate.yml's Rust Check (cargo check --locked) has run on PRs since 2026-06-04, and ruleset 15037341 has required it (plus TypeScript, a PR, and the merge queue, with no bypass actors) on develop since 2026-06-08. The late-May compile breakages predate that gate. So the gate isn't the gap.

The gap is that nothing re-checks develop after a commit lands — notably the periodic main → develop merge, which can produce a broken tree from two individually green parents. This PR adds a lightweight post-merge tripwire:

• push: [develop] trigger runs cargo check against the actual post-merge tip. It's a detector, not a gate — it can't block, but it flips develop's commit status red within ~1 min so the team sees breakage immediately instead of via a confusing local build failure.
• Tripwire = cargo check only. TypeScript/Treefmt are guarded to the PR/merge-queue path; compile breakage is the failure mode we keep hitting.
• Made the Rust Check genuinely light. It was 9 min — but the cargo check itself was only 52s; the other ~8 min was provisioning the full devenv profile (node/bun/sops/python) to run a Rust-only check. cargo check needs just the Rust toolchain + the system C compiler (libgit2-sys/libsqlite3-sys build their vendored C with cc), so this sets install-devenv: false + install-bun-deps: false. That drops it to a ~1 min toolchain setup and speeds up the PR check too. The full build (build.yaml) is untouched and still provides heavyweight coverage.

Test Plan

• No test plan needed

This PR validates itself: evaluate.yml runs on pull_request, so the Rust Check job on this PR exercises the devenv-free cargo check. If it's green here, the slim setup works (and is now ~1 min instead of ~9). YAML validated locally; per-job if guards confirmed (only rust-check runs on push).

Docs

• Docs updated (companion PR in darkmatter/nixmac-web: #___)
• No docs update needed

CI-only change.

---

🤖 Generated with Claude Code

[linear-code]

ENG-550

[github-actions]

🎨 Storybook preview

Open Storybook preview

Updated for 69bcae0

---

❌ Failed snapshots (1)

These stories' HTML snapshots changed. Current renderings (run bun run test:update-snapshots and commit if intended):

Widget/Steps/SetupStep › Default Config Required

[github-actions]

	Messages
📖	🤖 This PR touches CI / infra — reviewers please pay extra attention: .github/workflows/evaluate.yml

📋 PR Overview

Lines changed	21 (+21 / -0)
Files	0 added, 1 modified, 0 deleted
Draft / WIP	no
Has Test Plan	yes
No Test Plan Needed	no
New UI components	no
New Storybook stories	no
New Rust modules	no
New TS source files	no
New tests	no
package.json touched	no
Cargo.toml touched	no
Infra / CI touched	yes

🔬 Coverage

Report	Lines	Statements	Functions	Branches
apps/native/coverage/coverage-summary.json	25.6%	25.8%	24.4%	18.2%

Generated by 🚫 dangerJS against 69bcae0

[Andrew MacBride (amacbride)]

ENG-550 summary

Investigated the current state first, and the headline finding reframes the issue.

The pre-merge cargo-check gate ENG-550 asks for already exists. evaluate.yml's Rust Check (cargo check --locked) has run on PRs since 2026-06-04, and ruleset 15037341 has required it on develop (alongside TypeScript, a required PR, and the merge queue — no bypass actors) since 2026-06-08. The late-May compile breakages predate that gate, which is why they landed — there was nothing to bypass, the gate didn't exist yet.

What was actually missing: nothing re-checks develop after a commit lands. The one path that can still break develop is the recurring main → develop merge, which can produce a broken tree from two individually-green parents.

What this PR adds:

1. A post-merge tripwire — cargo check re-runs on every push to develop and flips its commit status red within ~2.5 min if it's broken. A detector, not a gate (the heavyweight build already gates the PR path).
2. Tripwire is cargo-check only (compile breakage is the failure mode we keep hitting); TypeScript/Treefmt stay on the PR/merge-queue path.
3. Made the check genuinely lightweight. The old Rust Check was ~9 min, but cargo check itself was only 52s — the other ~8 min was provisioning the full devenv profile (node/bun/sops/python) to run a Rust-only check. Skipping it (install-devenv: false) drops the job to 2m45s, validated green on this PR. Bonus: this speeds up the Rust Check on every PR too.

Net: develop now has both a pre-merge gate (already there) and a fast post-merge safety net (new), at ~52s of real compute.

(The Storybook Snapshot Tests red here is pre-existing develop drift from #373 — unrelated to this CI-only change.)