ci: shorten required feedback without dropping coverage

[ty-everett]

Program and scope

PR #617 spent 1,018 seconds reaching the merge gate. One wallet coverage shard took 612 seconds, dominated by two sequential real-HTTP sync scenarios; its siblings took 85–124 seconds. This change runs the two latency scenarios independently, moves package/documentation checks beside test execution, and lets required Sonar analysis overlap builds. All selected tests and the exact-head zero-findings Sonar gate remain required.

Codecov upload/processing moves to an advisory reporting job after the repository-owned 90% patch-coverage gate. The duplicate external codecov/patch ruleset requirement was removed administratively at05:02:54UTC with all other ruleset fields preserved; merge-gate continues to reject inadequate patch coverage itself. No product, dependency, release version, infrastructure or wallet source changes.

• Coordination: BotBoard [BotBoard][closed] ty-everett / wallet-release-ci — packages published and owned-wallet releases handed off #622.
• Exact head reviewed: 6b5062646fcbfaab9e4c4cb0ea1176d16d3fa805.
• Scope excludes ongoing identity corrections and both reference-wallet repositories.

Impact

• No public package source or manifest changed
• Security-sensitive boundary changed: CI scheduling and duplicate reporting requirement
• Documentation or examples changed

Verification

• Local: pnpm health:check, pnpm lint, pnpm format:check, pnpm build, pnpm typecheck all pass. YAML parses and all job dependencies resolve.
• Targeted orchestration/result/patch-coverage/Sonar tests: 29 pass, zero skips. They reject missing/failed/skipped required lanes, require both exact HTTP latency scenarios and coverage artifacts, and retain Sonar/90% coverage failure behavior.
• Hosted CI: 36097152312 is running on this exact head; this shared-workflow change selects the full governed graph.
• HTTP fixture bytes, authentication, retries, restart/integrity assertions, latency and deadlines are unchanged. Independent processes isolate the global transport spies.
• Performance: observed fix(sdk,wallet-toolbox): honor identity overlay matching in discoverByAttributes #617 Sonar wait79s, package checks71s, external processing29s are moved off the serial path. No measured improvement is claimed until new hosted timing evidence exists.
• I self-reviewed the complete diff for correctness, security, compatibility, public API, artifacts, dependencies, docs, and operations
• All applicable checks are terminal and successful on the exact head

Security and dependencies

• No dependency or lockfile change
• No new override, advisory dismissal, quality suppression, or skipped test
• Workflow permissions and lifecycle-script behavior remain least privilege
• Exact-head CodeQL and zero-new-finding Sonar checks are complete

CodeQL, Socket, dependency review, conformance, review-thread resolution, branch protection and immutable publication controls remain unchanged. No status is synthesized or accepted without its underlying checks. External report failure can only affect the advisory reporting job.

Release and operations

• No npm publication was performed from a workstation or from this PR
• No npm version bump is needed for shared CI/documentation-only changes
• Documentation records the required local coverage gate and advisory external report
• Hosted full-scope timing and administrative readback recorded

Rollback restores the previous workflow and adds codecov/patch back to repository ruleset19713320; the local90% gate remains required throughout.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ty-everett]

Maintainer review under the operator's explicit instruction to implement the CI wins, exact head 6b5062646fcbfaab9e4c4cb0ea1176d16d3fa805: all required checks pass, all selected package/coverage/platform/infrastructure lanes succeed, exact-head Sonar has zero findings, CodeQL has zero open PR alerts, and there are no review threads to resolve. The remaining external Codecov report is explicitly advisory.

The complete diff changes scheduling and reporting only. The strict result validator now requires the separate package-artifact lane. Both real-HTTP latency scenarios remain required coverage runs; their fixtures, authentication, retry/restart assertions and deadlines are unchanged. The regular wallet shards passed in101–164s, the zero-latency scenario in162s and the1,000ms scenario in357s; compare the prior612s combined critical wallet lane as an observation, not a refreshed performance baseline. All local health/lint/format/build/typecheck checks pass.

Ruleset19713320 already removes only duplicate codecov/patch; its other fields are unchanged. The owned90% patch gate, Sonar, CodeQL, Socket, dependency review, conformance and existing review/branch protections remain enforced. Ready for administrative integration under the authorized maintainer instruction; npm publication remains separately held for the peer identity follow-up.