[codex] Harden PR test-core DerivedData cache handling

[mimeding]

Summary

• cold-build DerivedData for pull_request test-core runs while preserving SPM source caching
• bump the cache salt so the next main run cannot reuse the suspect DerivedData entry
• keep DerivedData restore/save behavior for main and manual maintainer runs

Why

Multiple open PRs (#974, #940, #929) are failing test-core with EventSource unable to resolve C-module dependencies from restored DerivedData (CAsyncHTTPClient, CNIOLLHTTP, CNIOExtrasZlib, CNIOPosix, _NumericsShims). The failing #974 run restored an exact DerivedData key, so the previous non-exact-cache wipe is not sufficient.

Verification

• git diff --check
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/ci.yml")'

Product builds/tests are intentionally not run for this workflow-only change; GitHub CI is the verification target.

[mimeding]

Execution note: #975 is now fully green, including test-core (11m29s). This should land first because it clears the shared EventSource/DerivedData module-resolution failure affecting multiple otherwise unrelated PRs (#974, #940, #929, #976, #977).

Recommended next action: merge #975, then rerun/rebase the blocked PRs before debugging their code paths.

[mimeding]

#975 is back to ready after enforcing the new clean-PR rule.

What changed in the follow-up commits:

• Added pr-clean-gate, a final CI job that fails unless test-core, test-cli, swiftlint, and shellcheck all pass.
• Added scripts/ci/check-pr-clean.sh so maintainers/agents can reject PRs with missing, pending, cancelled, or failing checks.
• Updated the PR template, contributing docs, and .cursor rule to require attached green GitHub checks before a PR is marked ready.
• Stabilized ChatViewSandboxTests by taking the storage-path lock around synthetic-agent sandbox tests; the new gate caught this flake on the first run.

Verification:

• Local: git diff --check
• Local: YAML parse for .github/workflows/ci.yml
• Local: shellcheck --severity=warning scripts/ci/check-pr-clean.sh
• Local: swiftlint --strict Packages/OsaurusCore/Tests/Chat/ChatViewSandboxTests.swift
• Local: swift test --filter ChatViewSandboxTests
• GitHub: test-core, test-cli, swiftlint, shellcheck, update_release_draft, and pr-clean-gate all pass.
• New verifier: scripts/ci/check-pr-clean.sh osaurus-ai/osaurus 975 passes with 6 attached checks.

[tpae]

@mimeding actually there's logic to clear DerivedData cache when you "re-run" under github actions.