test: guard kernel architecture boundaries

[bigboateng]

Summary

• parse every kernel Go import declaration and reject software-delivery dependencies or fixtures
• add an expected-failure marker for the pending generic-runtime production consumer migration
• run the full Go race suite on Ubuntu and a focused race job for the kernel and software-delivery effects
• add an append-only release note

Boundary conformance

• Boundary: general kernel to software-delivery domain and CI execution
• Control law: kernel source and tests remain domain-neutral; race-sensitive packages run under the detector; the missing production consumer stays visible until migration T5
• Failure behavior: repository-contract or CI fails closed
• Production semantics: unchanged

Verification

• python3 -m unittest discover -s .github/tests -p 'test_*.py' -q (35 tests, one expected T5 failure)
• go test -race ./...
• go test -race ./kernel ./internal/softwaredelivery/effects
• go vet ./...
• go build ./...
• release-note validation and preflight
• git diff --check

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[github-actions]

Codex automated review

Verdict: patch is incorrect
Confidence: 0.96

The new import parser does not cover a legal, gofmt-preserved Go import form, so the migration guard can silently miss a real production consumer. Model-level verification is not recommended because this patch changes repository checks and CI rather than control-state semantics.

[github-actions]

Codex automated review

Verdict: patch is incorrect
Confidence: 0.98

The new architecture guard misses a valid Go import form, so a forbidden kernel dependency can be committed while CI remains green. Model-level verification is not recommended; a parser regression test is sufficient.

[github-actions]

Codex automated review

Verdict: patch is incorrect
Confidence: 0.99

The CI workflow rename disconnects the existing automatic release trigger, blocking release publication. Model-level verification is not recommended; the failure is deterministic and directly established by the workflow configuration.

[github-actions]

Codex automated review

Verdict: patch is correct
Confidence: 0.93

No actionable defect was established. The CI rename remains aligned with the automatic-release trigger, and the added architecture/race checks do not change runtime control behavior. Model-level verification is not recommended before merge.