fix(release): admit bun-serve-smoke into the required PR CI evidence set (#1335)

The Beta.2 publish dry-run (2026-09-05) failed closed: verifyPrCiProvenance
rejected the promotion run because 'dist/server Bun smoke' (job added by
#1228 / B2.5, after the Beta.1 publish) was outside REQUIRED_PR_CI_JOBS and
jobIdForDisplayName had no mapping for it. The set now matches the
pr-full-ci-evidence needs list, with a mechanical lockstep test so the
desync fails at development time, not at publish time. Part of #1288.

Co-authored-by: DevBot <devbot@openelement.dev>

Author: SisyphusZheng

tools/autoflow/__tests__/cli.test.ts

@@ -46,6 +46,7 @@ function matchingRun(): GitHubRunInfo {
       { name: 'autoflow-ci', status: 'completed', conclusion: 'success' },
       { name: 'dist/server Node smoke (Node 20)', status: 'completed', conclusion: 'success' },
       { name: 'dist/server Node smoke (Node 24)', status: 'completed', conclusion: 'success' },
+      { name: 'dist/server Bun smoke', status: 'completed', conclusion: 'success' },
       { name: 'workspace-qualification', status: 'completed', conclusion: 'success' },
       { name: PR_CI_EVIDENCE_JOB_NAME, status: 'completed', conclusion: 'success' },
     ],

tools/autoflow/__tests__/pr-ci-provenance.test.ts

@@ -50,6 +50,7 @@ function runInfo(overrides: Partial<GitHubRunInfo> = {}): GitHubRunInfo {
       { name: 'autoflow-ci', status: 'completed', conclusion: 'success' },
       { name: 'dist/server Node smoke (Node 20)', status: 'completed', conclusion: 'success' },
       { name: 'dist/server Node smoke (Node 24)', status: 'completed', conclusion: 'success' },
+      { name: 'dist/server Bun smoke', status: 'completed', conclusion: 'success' },
       { name: 'workspace-qualification', status: 'completed', conclusion: 'success' },
       { name: PR_CI_EVIDENCE_JOB_NAME, status: 'completed', conclusion: 'success' },
     ],

tools/autoflow/__tests__/pr-ci-workflow.test.ts

@@ -187,3 +187,28 @@ Deno.test('B2.12 (#1187): publication authenticates with npm Trusted Publishing/
   // npmjs registry configuration (registry config, not auth).
   assertStringIncludes(source, "registry-url: 'https://registry.npmjs.org'");
 });
+
+Deno.test(
+  'release-lane: REQUIRED_PR_CI_JOBS stays in lockstep with the pr-full-ci-evidence needs list',
+  async () => {
+    // The Beta.2 dry-run (2026-09-05) failed closed because bun-serve-smoke
+    // joined the workflow `needs` (B2.5) without joining the evidence
+    // validator's required set: the independently resolved run then carried a
+    // job "outside the required set". This guard makes the desync a test
+    // failure at development time, not a failed publish attempt.
+    const { REQUIRED_PR_CI_JOBS } = await import('../loop-evidence.ts');
+    const source = await Deno.readTextFile(CI_WORKFLOW_PATH);
+    const doc = parse(source);
+    const job = jobsOf(doc)['pr-full-ci-evidence'];
+    assert(job, 'autoflow-ci.yml lacks the pr-full-ci-evidence aggregation job');
+    const needs = job.needs ?? [];
+    const needsSet = [...needs].sort();
+    const requiredSet = [...REQUIRED_PR_CI_JOBS].sort();
+    assertEquals(
+      needsSet,
+      requiredSet,
+      'the pr-full-ci-evidence needs list and REQUIRED_PR_CI_JOBS must be identical sets: ' +
+        'update loop-evidence.ts (and this test) together with autoflow-ci.yml',
+    );
+  },
+);

tools/autoflow/loop-evidence.ts

@@ -126,11 +126,17 @@ export const PR_CI_ARTIFACT_PREFIX = 'pr-full-ci-evidence-';
  * `workspace-qualification` joined the set with #1276 (B1.3-F1): the definePage
  * route SSR tag-mismatch defect shipped because the workspace runtime
  * qualification was not CI-gated.
+ * `bun-serve-smoke` joined the set with #1228 (B2.5): the Bun consumer
+ * qualification is a required `needs` leg of pr-full-ci-evidence. The set MUST
+ * stay in lockstep with the `needs` list of the pr-full-ci-evidence job in
+ * autoflow-ci.yml — pr-ci-workflow.test.ts enforces that equality mechanically
+ * (the Beta.2 dry-run 2026-09-05 failed because this set lagged the workflow).
  */
 export const REQUIRED_PR_CI_JOBS = [
   'dependency-review',
   'autoflow-ci',
   'node-serve-smoke',
+  'bun-serve-smoke',
   'workspace-qualification',
 ] as const;
 
@@ -139,6 +145,7 @@ export function jobIdForDisplayName(name: string): string {
   if (name === PR_CI_EVIDENCE_JOB_NAME) return PR_CI_EVIDENCE_JOB_NAME;
   // Matrix legs expand the display name, e.g. "dist/server Node smoke (Node 24)".
   if (name.startsWith('dist/server Node smoke')) return 'node-serve-smoke';
+  if (name.startsWith('dist/server Bun smoke')) return 'bun-serve-smoke';
   return name;
 }