ci: run verification stages as parallel jobs to shorten PR feedback

[Brad-Edwards]

Summary

Shorten time-to-first-actionable PR feedback without weakening protected-branch verification. The single serial verify job that ran the whole graph in-process is split into independent, concurrent jobs (fast-checks, policy, tool-tests, typecheck, tests, distributions, docs); each fails fast on its own and a small change gets hygiene/lint feedback in seconds. SonarCloud now depends on tests alone (source + coverage) instead of the full graph. The PR Gate aggregator still requires every verification job plus Sonar, so coverage before a protected-branch merge is unchanged, and check_project_services pins the new, more granular gate contract. uv caching is enabled to offset per-job setup. The test suite stays a single shard (the suite is too small to justify deterministic sharding) and a change-based early-feedback lane was evaluated and not adopted; both decisions are documented.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #7

ADR Impact

• No ADR required

Changes

• Split the serial verify job in .github/workflows/ci.yml into per-stage parallel jobs; each runs exactly one nox session and is reproduced locally with that command
• Point the SonarCloud job at needs: [tests] so static analysis starts once source + coverage exist, not after the whole graph
• Rewrite PR Gate to require every verification job plus Sonar and fail closed (a toJSON(needs) jq assertion); it remains the single required status check, so branch protection is unchanged
• Update tools/check_project_services.py to pin the new gate contract (every stage present in the gate, fail-closed assertion) so no job can silently leave the gate
• Enable setup-uv caching on every job to offset repeated per-job setup
• Add docs/maintainers/ci.md (fast lane, full gate, job/shard ownership, change-lane evaluation, local reproduction, before/after timings); wire it into the mkdocs nav and cross-link from CONTRIBUTING.md

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Configured completion command passes
• No coverage regression

Ran make verify (full graph) and make precommit locally — all green: hygiene, policy, lint, tool-tests, typecheck, tests (8 tests, 100% coverage, coverage combined across base + cyborg), distributions (build + clean-install + identity proof), strict docs build. Validated the new PR Gate jq assertion against all-pass, verification-failure, same-repo-with-sonar-skipped (must fail), and fork-skip cases. tools/tests/test_project_services.py re-validates the updated gate contract against the real workflow file.

Ground Control Checks

• Configured repository policy command passes
• gc_evaluate_quality_gates passes or is unchanged by this repo-only change
• gc_run_sweep reviewed; findings fixed or recorded with rationale

Traceability

• IMPLEMENTS: (none — bug/refactor/maintenance run)
• TESTS: (none — documentation/configuration/structural-invariant run)

Checklist

• Code follows project coding standards (docs/CODING_STANDARDS.md)
• No business logic in API layer
• Domain layer has no framework imports
• Envers @Audited on new entities if applicable
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.