Consolidate required CI gate (#115)

docs/ci-runtime-evidence.md

@@ -0,0 +1,36 @@
+# Required CI runtime evidence
+
+This record is populated from the consolidated `CI / required` Gitea job. A
+qualifying sample consists of one deliberate cold native/dependency cache run
+and four normal warm-cache runs on `aarch64-unknown-linux-gnu`. Each uploaded
+`required-gate.json` contains per-stage elapsed time, Rust host/target, separate
+compiled-Cargo, dependency-download, native, and tool cache hit state,
+available peak-memory evidence, and the Skia binary outcome.
+
+The compiled target key includes Rust 1.97.1, the ARM64 GNU target, every Cargo
+manifest, `Cargo.lock`, required feature/policy configuration, and native
+installer inputs. CI-driver-only changes reuse the newest generation through a
+same-filesystem hard-link migration; Cargo still validates every fingerprint.
+To invalidate compiled artifacts, change a keyed build input. A deliberate
+`cold_cache` dispatch removes registry archives/index data, Git database data,
+pinned audit tools, OpenJPEG, and Skia. It retains immutable extracted registry
+sources and the compiled target so the cold dependency/native measurement does
+not manufacture source-mtime rebuilds unrelated to cache correctness.
+
+The pre-consolidation Gitea baseline was 13 automatic workflows and 333 runs.
+Successful maxima included 22.9 minutes for the native workspace, 32.0 minutes
+for Skia, 66.6 minutes for artifact audit, and 86.0 minutes for the release
+matrix. Native code generation had a 13.2-minute median and 18.5-minute maximum;
+even this one concern could exceed the new complete-gate budget.
+
+| Run | Cache | Elapsed | Result | Evidence |
+| --- | --- | ---: | --- | --- |
+| pending first consolidated run | cold | pending | pending | pending |
+| pending second consolidated run | warm | pending | pending | pending |
+| pending third consolidated run | warm | pending | pending | pending |
+| pending fourth consolidated run | warm | pending | pending | pending |
+| pending fifth consolidated run | warm | pending | pending | pending |
+
+Branch protection must require only `CI / required` after all five rows are
+green and at or below 15:00. Until then, this file deliberately records that
+runtime parity and branch-protection migration are not yet proven.