fix(ci): desktop-native-linux honors the classifier it depends on

.github/workflows/e2e-cli.yml

@@ -25,15 +25,18 @@ name: e2e-cli
 # any other PR carrying the `e2e-cli-gate` label, PLUS manual dispatch.
 #
 # Skip policy (see `.github/scripts/ci-classify-changes.ts`): the `classify` job
-# derives `run_static` / `run_runtime` from the PR diff and labels. Both expensive
-# jobs still START and report SUCCESS, but short-circuit to a "skipped-by-policy"
-# step when their work is not needed:
+# derives `run_static` / `run_runtime` from the PR diff and labels. All three
+# expensive jobs still START and report SUCCESS, but short-circuit to a
+# "skipped-by-policy" step when their work is not needed:
 #
 #   - docs-only diff (only `**/*.md(x)`, `docs/`, `.llm/`, `.agents/`, `.claude/`,
 #     and never `packages/`/`plugins/`/`apps/`/`deno.json*`/`deno.lock`/
 #     `.github/workflows/`) -> skip both.
 #   - `ci:skip-scaffold` -> skip scaffold-static; `ci:skip-e2e` -> skip
 #     scaffold-runtime; `ci:full` -> force both regardless.
+#   - `desktop-native-linux` has no dedicated classifier output yet (#1152 adds
+#     `needs_desktop`); until then it runs whenever EITHER scaffold tier runs and
+#     skips only when the classifier said neither is needed (#1151).
 #
 # The jobs run + report SUCCESS rather than using `paths-ignore`/job-level `if`,
 # so they never strand a required status check if promoted to one later. The
@@ -254,36 +257,60 @@ jobs:
   desktop-native-linux:
     name: desktop-native-linux (deb + signed updater)
     needs: classify
+    # Job always starts (so its status reports); real work is guarded by the
+    # classifier exactly like its two siblings (#1151). No dedicated desktop
+    # classifier output exists yet (#1152 adds `needs_desktop`), so the
+    # conservative proxy is: run whenever EITHER scaffold tier runs, skip only
+    # when the classifier said neither is needed.
+    # FAIL-CLOSED: if `classify` FAILED, this job still runs and RUN defaults to
+    # true — a skip requires classify to have SUCCEEDED with an explicit
+    # `run_static=false` AND `run_runtime=false`. `skipped` classify
+    # (applicability gate) keeps the old skip behavior.
     if: ${{ !cancelled() && needs.classify.result != 'skipped' }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    env:
+      RUN: ${{ needs.classify.result != 'success' || needs.classify.outputs.run_static == 'true' || needs.classify.outputs.run_runtime == 'true' }}
+      SKIP_REASON: ${{ needs.classify.outputs.reason }}
     steps:
+      - name: Skipped by policy
+        if: env.RUN != 'true'
+        # REASON contains raw changed-file names — never interpolate it into
+        # shell source; pass via env and print with printf.
+        run: |
+          printf '::notice::desktop-native-linux skipped by policy. %s\n' "$SKIP_REASON"
+
       - name: Checkout
+        if: env.RUN == 'true'
         uses: actions/checkout@v4
 
       - name: Setup Deno
+        if: env.RUN == 'true'
         uses: denoland/setup-deno@v2
         with:
           deno-version: "2.9.0"
 
       - name: Install native packaging and desktop prerequisites
+        if: env.RUN == 'true'
         run: >-
           sudo apt-get update && sudo apt-get install --yes
           bsdiff libgtk-3-0 libwebkit2gtk-4.1-0
 
       - name: Install workspace dependencies
+        if: env.RUN == 'true'
         run: deno install
 
       - name: Native desktop package, install, update, and rollback (one pass)
         id: native_suite
+        if: env.RUN == 'true'
         # TEMPORARY NON-BLOCKING POLICY: remove step tolerance when the packaged
         # runtime ships the #841 verification op. See the G7 drift entry
         # "Packaged runtime lacks the #841 verification op" for fail-closed evidence.
         continue-on-error: true
         run: deno task e2e:cli run deploy.desktop-native --cleanup --format pretty
 
       - name: Summarize native desktop upstream gap (LOUD, never masks suite evidence)
-        if: always()
+        if: always() && env.RUN == 'true'
         env:
           EVIDENCE: .llm/tmp/desktop-native-e2e/evidence.json
           NATIVE_SUITE_OUTCOME: ${{ steps.native_suite.outcome }}
@@ -309,7 +336,7 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload native desktop evidence
-        if: always()
+        if: always() && env.RUN == 'true'
         uses: actions/upload-artifact@v4
         with:
           name: e2e-cli-desktop-native-linux-report
@@ -353,6 +380,15 @@ jobs:
           static_outcome="$(describe_scaffold_lane "$RUN_STATIC" "$STATIC_RESULT")"
           runtime_outcome="$(describe_scaffold_lane "$RUN_RUNTIME" "$RUNTIME_RESULT")"
 
+          # Desktop has no dedicated classifier output yet (#1152): it is
+          # selected whenever either scaffold tier is (#1151).
+          if [ "$RUN_STATIC" = "true" ] || [ "$RUN_RUNTIME" = "true" ]; then
+            desktop_selected="true"
+          else
+            desktop_selected="false"
+          fi
+          desktop_outcome="$(describe_scaffold_lane "$desktop_selected" "$DESKTOP_NATIVE_LINUX_RESULT")"
+
           {
             echo "## Scaffold CI lane visibility"
             echo
@@ -363,4 +399,5 @@ jobs:
             printf '| `classify` | %s |\n' "$classify_outcome"
             printf '| `scaffold-static` | %s |\n' "$static_outcome"
             printf '| `scaffold-runtime` | %s |\n' "$runtime_outcome"
+            printf '| `desktop-native-linux` | %s |\n' "$desktop_outcome"
           } >> "$GITHUB_STEP_SUMMARY"