ci: support shared Zi quality workflow contracts

[ss-o]

Summary

Zi cannot reuse the organization quality workflows without losing extensionless Zsh coverage or exact candidate checks during promotion. Extend the shared workflows so Zi can adopt immutable callers while keeping product behavior tests in Zi.

• Add optional exact checkout refs to native Zsh and CodeQL, make CodeQL reusable, and give the workflows distinct concurrency groups.
• Add explicit extensionless sources and an optional nonempty inventory requirement to native Zsh checks. Reject unsafe explicit paths and keep compiled output outside the checkout.
• Remove cancellation for short required metadata checks, carrying the Zi fix into the shared owner. Retain normal commit-subject and trailer validation; Zi no longer needs its historical exemption because both maintained branches already contain the policy baseline.
• Test the actual native workflow block and retain commit-policy regression checks, wire native tests into CI, and update canonical workflow guidance and generated consumers.

Refs z-shell/zi#597 for the overlapping required-check cancellation defect. This PR addresses its shared-workflow counterpart; it does not close the Zi issue or claim to deliver the separate Zi adoption and repository settings changes.

Verification

• python3 automation/ci/test_zsh_ci.py: 7 tests passed, including invalid sources, empty inventories, symlinks, compilation failures, and failure propagation.
• bash automation/ci/test-commit-lint-policy.sh: 57 checks passed. The actual commit-message workflow block also validated 14 non-merge commits in Zi range 76a1a3d..9609445 without a historical exemption.
• Actionlint passed on all four changed workflows. Bash syntax and ShellCheck passed for the commit-policy test.
• Knowledge delivery checked 56 consumers; repository coverage checked 357 files. Agent policy and Zsh standard policy validators passed. git diff --check passed.
• Trunk was unavailable because its daemon was not running. Hosted checks and downstream Zi execution remain unverified at opening. These checks establish workflow behavior locally, not complete cross-platform Zsh compatibility.

Agent handoff

• Status: Ready for review.
• Current state: Shared workflow implementation and local regression checks are complete.
• Blockers: Current-head hosted checks and review of record are still required before merge.
• Next steps: Review and merge separately; adopt the reviewed published revision in Zi, verify actual hosted check names, then coordinate required-check settings. Zi's full promotion suite and contributor references are prepared separately.
• Related tracker/issues: fix(ci): duplicate edit and push runs leave cancelled required checks that block merges zi#597. Broader Zi quality and settings work is outside this PR.

[ss-o]

Fallback review under ADR-0026: maintainer elected, no Copilot request on 0559e5e

No actionable findings remain. Reviewed the full PR diff against base 49cf5b6, the exemption-removal fix, and integration of the updated attribution policy from main.

This is a maintainer-elected self-review, not independent approval. The maintainer separately authorized merge if the change is sound and repository gates pass.

• Correctness: The unreachable historical-subject exemption and inconsistent Git mock are removed. Commit lint retains incoming-subject validation and the advisory trailer behavior inherited from main. Short metadata checks no longer cancel one another.
• Native validation: Explicit sources reject absolute paths, parent traversal, missing files, and symlink leaves or ancestors. Native syntax and optional compilation accumulate failures; compiled output stays outside the checkout. Empty inventories fail when required. Seven executable workflow tests pass.
• Supply chain and permissions: Remote actions remain pinned. Checkout refs are passed as action inputs; source lists enter the shell through environment variables. CodeQL is limited to Actions analysis with job-scoped permissions. Native and CodeQL concurrency groups are distinct from each other and the intended caller groups.
• Coverage and maintenance: Tests are wired into Setup Zsh Tests, and canonical workflow/testing guidance matches generated consumers. Product behavior tests and supported-version declarations remain consumer-owned; this change does not claim Zi rollout or cross-platform support by itself.
• Local verification: 59 commit-policy checks, seven native-workflow tests, Actionlint on all four changed workflows, and knowledge delivery checks passed on this head. The earlier real-history probe validated 14 non-merge Zi commits without the removed exemption.
• Hosted verification: All 25 reported checks passed on the reviewed head, including Linux/macOS setup matrices, native-workflow regressions, commit policy, CodeQL, links, instruction validation, and org routing. GitHub reports the PR merge state as CLEAN; no review threads are open.
• Limits: Local Trunk remained unavailable without its daemon. No downstream Zi reusable-workflow execution was performed. Browser rendering at desktop and narrow widths was unavailable.

Recovery is a normal revert of this scoped workflow change. Existing immutable consumer pins are unchanged, so downstream adoption remains a separate reviewed change. The stale Zi adoption draft must omit the removed policy-baseline-sha input.