ci(release): kernel builds required + full walker-parity gate (#1401)

Three R1-era assumptions retired now that the kernel is the release's
headline rather than an optional speedup:

1. The kernel matrix drops continue-on-error (fail-fast stays false so
   every platform leg reports). A Rust toolchain failure now blocks the
   release instead of silently shipping wasm-only bundles under a
   Rust-engine banner. First real risk it guards: the vendored-grammar-C
   languages (kotlin/lua/scala/dart, incl. scala's 35MB parser.c) have
   never compiled on these runners — no release has run since the kernel
   merged.
2. The release-job gate expands from the two R1 suites to ALL
   __tests__/kernel-*.test.ts (14 files today: contract, grammar-source
   parity, and every language's walker byte-parity suite) — the glob
   keeps it current as languages land.
3. A missing linux-x64 prebuild at the gate is now a hard failure (the
   matrix guarantees it; absence means a wiring bug), and the artifact
   download step loses its best-effort flag for the same reason.

No packaging changes needed: build-bundle.sh already stages
lib/kernel/codegraph-kernel.node per target and pack-npm.sh repacks
bundles verbatim into the per-platform npm packages.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -30,13 +30,16 @@ permissions:
 
 jobs:
   # Native extraction-kernel prebuilds (docs/design/rust-kernel-migration-plan.md).
-  # The kernel is an OPTIONAL per-language speedup: a bundle without a .node
+  # As of 1.5.0 the kernel is the release's HEADLINE, not an optional extra, so
-  # runs the wasm extraction path unchanged. continue-on-error keeps a Rust
+  # this matrix is REQUIRED: a failed kernel build blocks the release instead of
-  # toolchain flake from ever blocking a release — the release job runs with
+  # silently shipping wasm-only bundles under a Rust-engine banner. Per-file
-  # whatever prebuilds succeeded. (Runner images ship rustup; build-kernel.sh
+  # wasm fallback still exists at runtime for erroring files and unsupported
+  # platforms — but every published bundle must carry its .node. Note the
+  # vendored-grammar-C languages (kotlin/lua/scala/dart) compile parser.c via
+  # the cc crate, so each leg needs its platform C toolchain (runner images
+  # ship one). (Runner images ship rustup; build-kernel.sh
   # adds each cross target itself.)
   kernel:
-    continue-on-error: true
     strategy:
       fail-fast: false
       matrix:
@@ -165,29 +168,30 @@ jobs:
           fi
 
       - name: Download kernel prebuilds
-        # Best-effort: whatever platform legs succeeded land in release/kernel/
+        # All legs are required (see the kernel job), so every target's
-        # (<target>/codegraph-kernel.node); build-bundle.sh includes a target's
+        # <target>/codegraph-kernel.node must be present in release/kernel/.
-        # kernel when present and falls back to the wasm path when not.
-        continue-on-error: true
         uses: actions/download-artifact@v4
         with:
           pattern: kernel-*
           merge-multiple: true
           path: release/kernel/
 
-      - name: Kernel contract + grammar-parity gate
+      - name: Kernel contract + full walker-parity gate
-        # Asserts the native grammars and the vendored wasm grammars are built
+        # Runs EVERY kernel suite (__tests__/kernel-*.test.ts — the wire
-        # from the same grammar revisions (node-kind/field tables compared id
+        # contract, the grammar-source parity table checks, and all 20
-        # by id) and that the .node speaks the expected wire contract.
+        # languages' walker byte-parity suites incl. torture/CRLF/defer pins)
-        # CODEGRAPH_KERNEL_EXPECT=1 turns a missing binary into a FAILURE here
+        # against the freshly built linux-x64 .node. The glob keeps this gate
-        # so the gate can't silently pass by not building the kernel.
+        # current as languages are added. CODEGRAPH_KERNEL_EXPECT=1 turns a
+        # missing binary into a FAILURE, and a missing prebuild fails outright
+        # — the matrix is required, so absence here means a wiring bug.
         run: |
           if [ -f release/kernel/linux-x64/codegraph-kernel.node ]; then
             mkdir -p codegraph-kernel/prebuilds/linux-x64
             cp release/kernel/linux-x64/codegraph-kernel.node codegraph-kernel/prebuilds/linux-x64/
-            CODEGRAPH_KERNEL_EXPECT=1 npx vitest run __tests__/kernel-scaffold.test.ts __tests__/kernel-grammar-parity.test.ts
+            CODEGRAPH_KERNEL_EXPECT=1 npx vitest run __tests__/kernel-*.test.ts
           else
-            echo "::warning::no linux-x64 kernel prebuild — skipping kernel gate (bundles ship wasm-only)"
+            echo "::error::linux-x64 kernel prebuild missing despite required matrix"
+            exit 1
           fi
 
       - name: Build all platform bundles