[eric] ci: chain the four new preflight verifiers (selftest, rigs, race, matrix) at the head of verify-all and add hostile-env legs to e2e.yml so network=blocked + appdata=readonly + lang=de-DE all run on every push

.github/workflows/e2e.yml

@@ -61,6 +61,36 @@ jobs:
         shell: bash
         run: node scripts/ci/selftest-gate.js
 
+      # Preflight Layer 1+2+3+4 (unit, hang fuzz, failure rigs, race) - pure node, ~5s.
+      - name: Preflight selftest (Layers 1+2)
+        shell: bash
+        run: node scripts/ci/selftest-preflight.js
+      - name: Preflight failure rigs (Layer 3)
+        shell: bash
+        run: node scripts/ci/verify-preflight-rigs.js
+      - name: Preflight race / cache (Layer 4)
+        shell: bash
+        run: node scripts/ci/verify-preflight-race.js
+
+      # Preflight Layer 5: hostile-env scenarios. Each leg asserts the verdict
+      # matches the expected envelope for that scenario; network=blocked
+      # producing 'fail' instead of 'warn' is the false-positive bug class.
+      - name: Preflight matrix (normal)
+        shell: bash
+        run: node scripts/ci/verify-preflight.js
+      - name: Preflight matrix (network=blocked must -> warn)
+        shell: bash
+        env: { OPENSWARM_TEST_NETWORK: blocked }
+        run: node scripts/ci/verify-preflight.js
+      - name: Preflight matrix (appdata=readonly must -> fail)
+        shell: bash
+        env: { OPENSWARM_TEST_APPDATA: readonly }
+        run: node scripts/ci/verify-preflight.js
+      - name: Preflight matrix (lang=de-DE must stay -> ok)
+        shell: bash
+        env: { OPENSWARM_TEST_LANG: de-DE }
+        run: node scripts/ci/verify-preflight.js
+
       - name: Build packaged app (Windows)
         if: startsWith(matrix.os, 'windows')
         shell: pwsh
@@ -139,6 +169,15 @@ jobs:
       - name: Gate selftest (mutation)
         shell: bash
         run: node scripts/ci/selftest-gate.js
+      - name: Preflight selftest + rigs + race + matrix (Layers 1-5)
+        shell: bash
+        run: |
+          node scripts/ci/selftest-preflight.js
+          node scripts/ci/verify-preflight-rigs.js
+          node scripts/ci/verify-preflight-race.js
+          node scripts/ci/verify-preflight.js
+          OPENSWARM_TEST_NETWORK=blocked node scripts/ci/verify-preflight.js
+          OPENSWARM_TEST_APPDATA=readonly node scripts/ci/verify-preflight.js
       - name: Build packaged app (Windows)
         shell: pwsh
         run: pwsh -NoProfile -File scripts/build-app-win.ps1

scripts/ci/verify-all.js

@@ -27,6 +27,10 @@ function main() {
 
   const steps = [
     // Pure-logic gates run first - cheap, no build needed, fail fast.
+    ['preflight selftest (Layer 1+2: unit + hang fuzz)', 'selftest-preflight.js', []],
+    ['preflight rigs (Layer 3: failure simulators)', 'verify-preflight-rigs.js', []],
+    ['preflight race (Layer 4: parallel + cache)', 'verify-preflight-race.js', []],
+    ['preflight matrix (Layer 5: hostile-env scenario)', 'verify-preflight.js', []],
     ['deps fully pinned (reproducible backend builds)', 'verify-deps-pinned.js', []],
     ['no build-host paths leaked into the artifact', 'verify-host-leakage.js', appArg],
     ['bundled python runs (--version + import smoke)', 'verify-python-health.js', appArg],