ci: run Git compatibility as a free hosted matrix, one Git version per job (#36106)

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

.github/workflows/pr.yml

@@ -569,8 +569,17 @@ jobs:
       needs.code_paths.result == 'success' &&
       needs.code_paths.outputs.git_compatibility == 'true' &&
       needs.preflight.result == 'success'
-    # Three parallel lanes (two through Docker) exceed real-Git test timeouts on 4-vCPU hosted runners.
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    # One free hosted runner per lane: three lanes sharing one 4-vCPU runner pushed real-Git tests past their timeouts.
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - git: '2.25.5'
+          - git: '2.38.1'
+            image: alpine/git:edge-2.38.1
+          - git: '2.49.1'
+            image: alpine/git:v2.49.1
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Checkout
@@ -581,50 +590,26 @@ jobs:
       - uses: ./.github/actions/install-node-dependencies
 
       - uses: ./.github/actions/prepare-git-compatibility
+        if: '!matrix.image'
 
-      - name: Verify Git binary compatibility matrix
+      - name: Verify Git ${{ matrix.git }} compatibility
         env:
           ORCA_BACKGROUND_LAUNCH: '1'
+          ORCA_GIT_COMPAT_VERSION: ${{ matrix.git }}
+          ORCA_GIT_COMPAT_IMAGE: ${{ matrix.image }}
         run: |
-          specs=(
-            "alpine/git:edge-2.38.1|2.38.1"
-            "alpine/git:v2.49.1|2.49.1"
-          )
-          # Pull before tests so a sibling’s timed lane cannot be stalled by the first image download.
-          for spec in "${specs[@]}"; do
-            docker pull --quiet "${spec%%|*}"
-          done
-
-          pids=()
-          (
-            ORCA_GIT_COMPAT_BINARY="$HOME/.cache/orca-git-compat/git-2.25.5/git" \
-              GIT_EXEC_PATH="$HOME/.cache/orca-git-compat/git-2.25.5" \
-              ORCA_GIT_COMPAT_VERSION="2.25.5" \
-              pnpm exec vitest run --config config/vitest.config.ts \
-              src/shared/git-binary-compatibility.test.ts \
-              src/main/git/worktree-safety-real-git.test.ts \
-              src/main/git/worktree-rebase-update-refs-real-git.test.ts
-          ) &
-          pids+=("$!")
-
-          for spec in "${specs[@]}"; do
-            (
-              image="${spec%%|*}"
-              version="${spec#*|}"
-              ORCA_GIT_COMPAT_IMAGE="$image" ORCA_GIT_COMPAT_VERSION="$version" \
-                pnpm exec vitest run --config config/vitest.config.ts \
-                src/shared/git-binary-compatibility.test.ts \
-                src/main/git/worktree-safety-real-git.test.ts \
-                src/main/git/worktree-rebase-update-refs-real-git.test.ts
-            ) &
-            pids+=("$!")
-          done
-
-          status=0
-          for pid in "${pids[@]}"; do
-            wait "$pid" || status=1
-          done
-          exit "$status"
+          if [ -n "$ORCA_GIT_COMPAT_IMAGE" ]; then
+            # Pull outside the timed tests.
+            docker pull --quiet "$ORCA_GIT_COMPAT_IMAGE"
+          else
+            unset ORCA_GIT_COMPAT_IMAGE
+            export ORCA_GIT_COMPAT_BINARY="$HOME/.cache/orca-git-compat/git-$ORCA_GIT_COMPAT_VERSION/git"
+            export GIT_EXEC_PATH="$HOME/.cache/orca-git-compat/git-$ORCA_GIT_COMPAT_VERSION"
+          fi
+          pnpm exec vitest run --config config/vitest.config.ts \
+            src/shared/git-binary-compatibility.test.ts \
+            src/main/git/worktree-safety-real-git.test.ts \
+            src/main/git/worktree-rebase-update-refs-real-git.test.ts
 
   # Run pinned real Codex: thread/read must repair an unindexed rollout’s threads row; stub-only units cannot detect upstream removal of this behavior.
   codex_index_heal_contract:

docs/readme/ci-runners.md

@@ -3,20 +3,20 @@
 Default to free GitHub-hosted standard runners: the repository is public and the
 Enterprise plan allows 1,000 concurrent jobs (50 macOS). Use Blacksmith only for:
 
-- `pr.yml` Git compatibility: its parallel real-Git lanes, two through Docker,
-  exceed test timeouts on 4-vCPU hosted runners.
 - macOS packaging: adhoc, hourly, daily and `release-mac-build.yml`. Hosted
   `macos-15` cannot boot the packaged x64 terminal host that `afterPack` verifies.
 - The adhoc Windows build (a developer is waiting).
 - Hardware-sensitive performance benchmarks. Operation-count contracts
   (`performance-contracts.yml`) are not, and run hosted.
 
-PR checks run entirely on hosted runners except Git compatibility. Unit tests
+PR checks run entirely on hosted runners. Unit tests
 run as 12 shards on `ubuntu-24.04-arm`, which match the old five 8-vCPU
 Blacksmith shards; `ORCA_UNIT_FULL_SHARD_COUNT` tunes the count. Preflight (lint
 and typecheck) also runs on hosted ARM: shards, packaging and the layout oracle
 do not wait for it, so its slower runner stays off the gate's critical path.
-The layout oracle and advisory e2e lanes run on `ubuntu-24.04`.
+The layout oracle and advisory e2e lanes run on `ubuntu-24.04`. Git
+compatibility runs one Git version per hosted job: three lanes sharing one
+4-vCPU runner pushed real-Git tests past their timeouts.
 
 Everything else, including the hourly and daily Windows builds, template
 qualification and node-server lanes, runs on hosted `ubuntu-*`, `macos-15` and