toolkit merge: drop Turbo, pnpm-native orchestration

[BYK]

Sub-task of the toolkit monorepo merge (master issue linked below). Plan: https://gist.github.com/BYK/8c0ce6cec64608f41fe5654b7827228e

Task orchestration without Turbo (pnpm-native).

• Root build/typecheck/test scripts use pnpm-recursive workspace orchestration.
• Finish or explicitly descope incremental TypeScript project references: Cloudflare has tsc -b references, while the CLI has no references.
• Remove Turbo from the root toolchain; current main has no turbo.json or Turbo dependency.
• CI discovers changed workspace projects and builds their dependencies with pnpm workspace selectors (test.yml, scripts/ci-projects.mjs).
• Build/deploy the Cloudflare workspace with pnpm; the exact-version production Worker passed protected deployment and live smoke checks after Toolkit #1400.

See §4.1.

[BYK]

Master tracking issue: #1248

[BYK]

Affected-package CI design

Adopt one convention-based CI framework for every pnpm workspace package. New packages inherit safe defaults automatically; package configuration exists only for justified exceptions.

Workflow graph

detect affected graph
        ↓
build affected closure once
        ↓
validate affected packages [matrix]
        ↓
repository/product boundary checks
        ↓
required

Detection

• Compare the literal PR head with the immutable PR base SHA.
• Select directly changed workspace packages plus all dependents.
• Compute the complete dependency closure needed to build those affected packages.
• Root dependency, CI, or shared-tooling changes select every package.
• Package deletion or rename selects every package because pnpm cannot select a removed package.
• Keep explicit semantic edges that are not represented by workspace: dependencies, including CLI-generated docs → apps/cli-docs.

Build once

Run the affected dependency closure once, in pnpm topological order:

pnpm --filter "...[$BASE_SHA]..." --if-present run build

Upload one run-scoped workspace build artifact containing declared outputs. Matrix jobs download that artifact. Never rebuild dependencies in each package job, and never rely on GitHub cache for correctness. Caches remain an optional speed layer only.

Package matrix

Emit package identities and reviewed metadata, never arbitrary shell commands. Each selected package gets one independent check with the same name and default contract:

build
typecheck
lint
test:ci

After restoring the shared build artifact, each matrix entry runs only package-local validation:

pnpm --filter "$PACKAGE" run typecheck
pnpm --filter "$PACKAGE" run lint
pnpm --filter "$PACKAGE" run test:ci

Missing default scripts fail closed. A new package cannot silently avoid tests by omitting test:ci.

Overrides

Support a small validated metadata schema for genuine exceptions, such as Node version, output paths, coverage path, or an intentionally disabled phase. Every disabled default requires a checked-in reason. Resolve target IDs through static code/config; never execute matrix-provided shell.

Conventional build outputs can cover dist/**, build/**, and generated directories. Packages declare additional outputs only when required. Artifact identity includes the exact head SHA and lockfile hash.

Boundary checks

Keep checks that do not belong to one package outside the generic matrix, but drive them from the same affected-target output:

• MCP generated definitions always run because outputs live outside package roots.
• CLI compiled-binary E2E retains its Node/runtime contract.
• CLI docs generation/build follows the explicit CLI → docs edge.
• MCP smoke tests, clean-consumer packaging, deployment canaries, and evals remain independent boundary jobs with narrow triggers.
• Evals must never run for unrelated changes.

Required status

Always emit one stable required aggregate status. It verifies every selected matrix and boundary job succeeded or was intentionally skipped. Branch protection requires only this stable result, so adding a workspace package never requires changing required-check configuration.

Invariants

• Every affected package is validated independently.
• Every affected dependency is built exactly once.
• CLI and MCP logs, timing, and failures are never intermixed in one serial job.
• New packages inherit build, typecheck, lint, test, reporting, caching, and required-gate coverage without bespoke workflow edits.
• Overrides are explicit, reviewed, schema-validated, and rare.

This incorporates the Slack review: split the giant test flow into independently triggered jobs, especially for evals, while retaining one maintainable infrastructure and one stable required status.