Merge upstream/main (#2667 shared CI gate workflow) into round3a-integration

.github/workflows/ci.yml (add/add with #2302): upstream's, which runs the
same `cargo xtask ci` gate through craft-common-actions' gate.yml. #2302's
workflow is superseded; its `ci --quick` (xtask) stays.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -1,73 +1,32 @@
-# The quality gate (`cargo xtask ci`: fmt, clippy, heif, tests, parity, layers, assets, wasm) on
-# every pull request and every push to main, so the full run happens here rather than on the
-# machine of everyone with a branch open. Locally, `cargo xtask ci --quick` checks what a branch's
-# changes can break in a few minutes; this job is the merge gate.
-#
-# Linux only: macOS / Windows test jobs are #1148. Standard GitHub-hosted runner (free for public
-# repositories), never a larger one.
 name: CI
 
+# Quality gates for every push to main and every pull request (`cargo xtask ci`), through the
+# suite's shared gate workflow in craft-common-actions.
 on:
   push:
     branches: [main]
   pull_request:
   workflow_dispatch:
 
-concurrency:
-  # A pull request's pushes share one group, so a new push supersedes the run of the old one.
-  # Every other run (a push to main, a manual one) gets a group of its own: a group keeps only one
-  # active and one pending run, so sharing one would let a later push replace a queued run and skip
-  # its `cargo xtask ci` — and every push to main is meant to get a full run.
-  group: ${{ github.event_name == 'pull_request' && format('ci-{0}', github.ref) || format('ci-{0}', github.run_id) }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 permissions:
   contents: read
 
-env:
-  CARGO_TERM_COLOR: always
-  # a fresh build every run: incremental state is only overhead, and it bloats the cache
-  CARGO_INCREMENTAL: 0
-  RUST_BACKTRACE: 1
-  # one job per runner: the machine-wide CI lock (xtask/src/ci_lock.rs) has nothing to wait for
-  LIGHTCRAFT_CI_LOCK: "off"
+# A newer push to a PR branch cancels its older run; every push to main runs to the end.
+concurrency:
+  group: ci-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  xtask-ci:
-    name: cargo xtask ci (Linux x86_64)
-    runs-on: ubuntu-latest
-    timeout-minutes: 90
-    env:
-      CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-      CRAFT_FONTS_REQUIRED: "1"
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      # the font build input, so the Japanese and Chinese font tests run (they skip without it)
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          repository: storytold/craft-fonts
-          ref: 3d9ab3a132ed0eff457e424226a435a901da30d3 # as freebsd.yml; bump deliberately
-          path: craft-fonts
-          persist-credentials: false
-      - name: Install system libraries
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev libgl1-mesa-dev
-      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
-        with:
-          components: rustfmt, clippy
-          targets: wasm32-unknown-unknown
-      # dependencies only (rust-cache drops the workspace's own artifacts), saved from main and
-      # restored by pull requests
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          key: ci
-          save-if: ${{ github.ref == 'refs/heads/main' }}
-      - name: cargo xtask ci
-        run: cargo xtask ci
-      - name: Job summary
-        if: ${{ !cancelled() }}
-        run: cat target/ci/summary.md >> "$GITHUB_STEP_SUMMARY" || true
+  gate:
+    # Tracks @main so suite-wide CI fixes reach every app without a PR in each repository.
+    uses: storytold/craft-common-actions/.github/workflows/gate.yml@main
+    with:
+      # Same craft-fonts commit as release.yml.
+      craft-fonts-ref: a71c20e30af613287c504f7e685ca8fad77752bc
+      timeout-minutes: 90
+      # xtask ci runs cargo test: the demo scene cache is per process, so nextest is slower here.
+      tools: ""
+      packages: >-
+        pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcb1-dev libxcursor-dev
+        libxrandr-dev libxi-dev libfontconfig1-dev libfreetype-dev mesa-vulkan-drivers
+        libgl1-mesa-dev libdbus-1-dev

.github/workflows/freebsd.yml

@@ -1,23 +1,18 @@
 # FreeBSD build and package check in a QEMU VM.
 name: FreeBSD
 
+# The VM build is slow, so it runs nightly on main and on pushes to `release`, not on every pull
+# request: a drifted dependency still shows up within a day, and always before a release ships.
+# PRs that change the FreeBSD workflow or packaging itself still run it.
 on:
   push:
-    branches: [main]
-    paths:
-      - ".github/workflows/freebsd.yml"
-      - "packaging/freebsd/**"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/**"
+    branches: [release]
   pull_request:
-    branches: [main]
     paths:
-      - ".github/workflows/freebsd.yml"
-      - "packaging/freebsd/**"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/**"
+      - .github/workflows/freebsd.yml
+      - packaging/freebsd/**
+  schedule:
+    - cron: "7 4 * * *"
   workflow_dispatch:
 
 concurrency:

.github/workflows/windows-arm64.yml

@@ -5,23 +5,17 @@
 # on GitHub Actions' native windows-11-arm runner.
 name: Windows ARM64
 
+# Nightly on main and on pushes to `release` (dependency and runner-image drift shows up within a
+# day, and always before a release ships), and on PRs that change the Windows packaging itself.
 on:
+  schedule:
+    - cron: "3 5 * * *"
   push:
-    branches: [main]
-    paths:
-      - ".github/workflows/windows-arm64.yml"
-      - "packaging/windows/**"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/**"
+    branches: [release]
   pull_request:
-    branches: [main]
     paths:
-      - ".github/workflows/windows-arm64.yml"
-      - "packaging/windows/**"
-      - "Cargo.toml"
-      - "Cargo.lock"
-      - "crates/**"
+      - .github/workflows/windows-arm64.yml
+      - packaging/windows/**
   workflow_dispatch:
 
 concurrency: