ci: gate native suites with isolated browser fixtures

docs/maintainers/native-test-coverage.md

@@ -0,0 +1,38 @@
+# Native test merge gate
+
+`Native test suites` runs on pull requests, dev/main pushes and manual dispatch.
+`Authoritative native suites` fails unless both the native Node and complete
+Chromium jobs succeed; it has no continue-on-error, retries or path bypass.
+Repository administrators must require this check alongside the four pytest
+checks in branch protection. The audited public dev branch had no protection or
+ruleset, so merely adding workflow jobs cannot prevent a manual merge.
+
+`tests/native-ci-manifest.json` exhaustively partitions all native Node files:
+16 run in the native job,14 through existing pytest wrappers, one through the
+existing frontend architecture CI step, and the formerly live email-reply file
+through an explicitly identified Playwright driver. The manifest validator fails
+for omitted/duplicate/unreachable entries. Node emits individual JUnit identities
+and propagates its failure exit. No native file is newly run in each pytest shard.
+
+The browser job uses the existing one-worker Chromium config and all original129
+cases, plus one driver for the native email-reply contract. Its ephemeral account,
+SQLite DB and server are created by the config/setup; reuseExistingServer remains
+false. NPX startup is offline/cache-only in a private cache; Notes/editor behavior
+and Python MCP services remain real. No developer app or external account is used.
+
+Default CI trace suppression remains intact. Only this job's explicit opt-in plus
+a newly generated authenticated synthetic fixture marker permits failure traces.
+The existing structured sanitizer runs before artifacts are uploaded; invalid
+ownership, failed sanitization and missing tooling purge sensitive artifacts.
+Never upload the fixture directory, database or browser storage state.
+
+The stroke budget now excludes measured synthetic event-delivery pacing and also
+bounds actual Chromium main-thread work at the original5s. All240 samples and
+pixel/thumbnail/undo/redo assertions remain. Per-case timing attachments expose
+both clocks rather than treating driver frame cadence as application work.
+
+Three Bombadil properties remain opt-in: they require a Bombadil/browser scenario
+and bounded fuzz campaign; no authoritative execution is claimed. The two model
+smoke scripts require supplied model endpoints/models and remain explicit live
+operations. No credentials or live-service authorization are implied by CI setup.
+Firefox/WebKit alternatives remain opt-in and are not certified by Chromium CI.