ci: wire the DEV-2203 suites — post-deploy smoke, weekly canary, monthly matrix

[danielzytohoc]

Last in the DEV-2203 stack. Stacked on #187 — merge the stack bottom-up (#181 → #182 → #183 → #184/#185 → #186 → #187 → this).

The coverage layers this creates

Layer	Trigger	Containers
PR CI (unchanged)	every PR	0 — deterministic only, now incl. style-panel/version-pin/download/share-UI
Post-deploy @smoke	both deploy workflows, via workflow_call	1 — one render per engine, share fixture, docs example, one Style round-trip
Weekly canary	Mon 05:00 UTC, prod, AI on	~8, strictly serialized
Monthly full matrix	1st, 05:00 UTC	~50, --workers=2, unchanged discipline

e2e-live.yml

• New dispatch inputs: ai (LLM answer checks), pkg_pr_new_ref (one real container at a pkg.pr.new build — DEV-2198 validation days).
• Folds in the three orphaned live specs nothing ever ran: row-striping, preview-recovery's live half, import-live.
• Steps split by what they hold: sandpack/API-read specs run parallel; container suites strictly --workers=1; the authed share step pre-checks E2E_BROKER_TOKEN against the broker and turns rot into a ::warning, not a red run.
• Concurrency: mode-keyed as before, smoke calls keyed by run id, deployed/canary runs never cancellable (cancelled runs strand container sessions — cleanup lives in finally).

Notes

• runner/AGENTS.md CI/CD table updated.
• All four YAML files parse-checked. Before enabling the cron in anger: one manual dispatch against prod with everything on is the real proof — I'd do it right after the stack merges.
• The smoke jobs add ~8–10 min after each deploy; the API deploy's smoke boots exactly the container image that deploy just rebuilt.

---

Note

Medium Risk
Changes deploy and scheduled CI behavior against prod and the global five-slot container pool; mis-timed concurrency or smoke gating could miss regressions or add deploy latency, but no application auth or data-path code is modified.

Overview
DEV-2203 turns the manual-only live E2E workflows into a layered schedule: PR CI stays deterministic; prod gets post-deploy @smoke, a weekly canary, and a monthly starter matrix, with container concurrency keyed so cancellations do not strand Tier-2 sessions.

e2e-live.yml now runs on workflow_dispatch (new ai and pkg_pr_new_ref inputs), weekly schedule (Mon 05:00 UTC, prod + AI), and workflow_call with smoke: true. A shared BASE_URL env resolves prod for schedules. Steps split into a fast @smoke path, parallel Sandpack/API-read specs (including previously orphaned row-striping, import-live, etc.), serialized container suites (--workers=1), optional pkg.pr.new validation, broker-token-gated authed share (warn/skip on rot, no traces), and AI live checks. Timeout rises to 90m; concurrency groups separate local, deployed, canary, and per-run smoke.

master.yml adds a smoke job that calls e2e-live.yml once after successful deploy-authoring or deploy-api (not twice on shared path changes).

e2e-starter-matrix.yml adds a monthly cron (1st at 03:00 UTC, staggered from the weekly canary) and prod fallback when schedule has no inputs.

runner/AGENTS.md CI/CD table documents the new triggers and smoke wiring.

^{Reviewed by Cursor Bugbot for commit 53e7a0b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ef126e9. Configure here.}