One gate script for local runs and CI, with --locked on every cargo build, test and clippy #822

Goal

Contributors and CI run the same gate from one script, scripts/gate.sh, and every Cargo build, test and lint step uses --locked, so CI tests exactly the checked-in Cargo.lock and a stale lockfile fails instead of being re-resolved silently.

Context

• The gate is written down three times: AGENTS.md:25-48 (fmt, clippy, test, build; then npx tsc -b, npm run lint, npx vitest run in apps/smart-ssh-community/frontend), the test job of .github/workflows/community.yml:35-181 (same steps plus the app-logic Tauri-free boundary check :103-120, npm run generate-notices, npm run build, and on Linux xvfb-run -a + SMART_SSH_REQUIRE_CLIPBOARD_TESTS=1 for the clipboard round-trip test crates/app-shell/src/file_clipboard.rs:323-327), and the developer's memory. There is no executable "run the whole gate" command.
• No cargo build/test/clippy/tree call in .github/workflows/*.yml uses --locked (community.yml:67,81,87,90,112,421,430, mutants.yml:78); only cargo install … --locked does. A Cargo.lock that does not match the manifests is re-resolved in CI, so the tested graph differs from the committed one.
• Windows constraint (community.yml:75-78): the Windows test job must not run Cargo under Git Bash (its perl cannot build the vendored OpenSSL), so Windows keeps the default shell for the Cargo steps.

Requirements

• New scripts/gate.sh (bash, set -euo pipefail, runnable from any directory – it cds to the repo root), with named stages that can be run alone or all in order:
  • rust: cargo fmt --all --check; cargo clippy --workspace --all-targets --locked -- -D warnings; cargo test --workspace --locked --no-fail-fast; cargo build --workspace --locked.
  • boundary: the app-logic Tauri-free check moved from community.yml:103-120 (same regex, same explicit failure path when cargo tree itself fails), with --locked.
  • frontend: in apps/smart-ssh-community/frontend: npm ci (only with --ci, otherwise skipped when node_modules exists), npx tsc -b, npm run lint, npx vitest run, npm run build.
  • Usage: scripts/gate.sh [--ci] [rust|boundary|frontend …]; no stage = all; unknown stage = exit 2 with usage.
  • --ci: sets SMART_SSH_REQUIRE_CLIPBOARD_TESTS=1; on Linux runs cargo test under xvfb-run -a and fails with a clear message if xvfb-run is missing. Without --ci the clipboard test may skip as today.
  • Prints a header per step and, at the end, which stages ran.
• community.yml test job: on Linux and macOS the Cargo, boundary and frontend steps call scripts/gate.sh --ci <stage> (one CI step per stage, so the step names stay readable). On Windows the Cargo steps stay inline in the default shell with exactly the same commands and flags as the script (--locked, --no-fail-fast), and a comment pointing to scripts/gate.sh and the reason. npm run generate-notices and the cargo-about install stay in the workflow (not part of the local gate).
• --locked on every other cargo build, cargo test, cargo clippy and cargo tree call in .github/workflows/*.yml (real-app-tests, mutants.yml, openssh-jump-tests.yml) and in .github/workflow-proposals/mutants.yml. cargo tauri android build has no --locked; leave it and add a comment.
• AGENTS.md: the gate section names scripts/gate.sh (with the stage list and --ci) as the single way to run the gate and explains --locked in one sentence; the four-line command block is replaced by the script call. Keep the existing explanations (why cargo build without test-support matters, browser tests) next to it.
• Guard test (vitest, next to tauriCommandsCheck.test.ts, e.g. src/cargoLockedCheck.test.ts, reading the files from the repo): every line in .github/workflows/*.yml, .github/workflow-proposals/*.yml and scripts/gate.sh that runs cargo build, cargo test, cargo clippy or cargo tree contains --locked (comment lines ignored); counter-proof on a fixture string.

Acceptance Criteria

• scripts/gate.sh runs all stages green on a clean checkout of the PR branch (Linux), and scripts/gate.sh rust alone runs only the Rust stage
• scripts/gate.sh --ci rust on Linux runs cargo test under xvfb-run with SMART_SSH_REQUIRE_CLIPBOARD_TESTS=1 (visible in the CI log of the PR)
• After adding a dependency to a crate's Cargo.toml without updating Cargo.lock (locally, not committed), scripts/gate.sh rust fails at the first Cargo step with Cargo's "lock file needs to be updated" error (shown in the PR description)
• The cargoLockedCheck guard passes and its counter-proof fails a line without --locked
• community.yml test job is green on Linux, Windows and macOS; real-app, browser and Android jobs are green
• AGENTS.md describes the gate only through scripts/gate.sh
• Relevant automated tests pass

Technical Notes

• .github/ change → needs the maintainer's approval before merge (CODEOWNERS).
• The clipboard test and the boundary check are guards the CI must not skip silently; keep the explicit error paths.
• Keep the job and check names of community.yml unchanged (they are required status checks).

Spec impact: none

Related Work

• Copy a remote file to the system clipboard as a file #358 (clipboard test under xvfb), Check Tauri command definitions, registrations and frontend calls in CI #101 (Tauri command check)