…ifact grid

The GitLab side is green; the failure emails were GitHub Actions. Two verified
signatures, each fixed with the documented built-in (config is code — no hand-rolling):

1. "Restore cache failed: Dependencies file is not found ... pattern: go.sum"
   The module root is go/ (and cli/), not the repo root. Added setup-go's
   cache-dependency-path input to every failing setup-go (ci.yml -> go/go.sum;
   build.yml -> go/go.sum + cli/go.sum). deps.yml left alone (it was passing).

2. `task: Command "sysctl -n hw.ncpu" failed` (ubuntu exit 1 / windows 127)
   go-task evaluates global sh-vars eagerly, so the NCPU var must succeed on every
   platform. Hardened the fallback chain with a literal floor:
   getconf ... || nproc ... || sysctl -n hw.ncpu 2>/dev/null || echo 4
   Mac path unchanged (getconf _NPROCESSORS_ONLN already returns the core count = 32).

build.yml rewritten to an HONEST matrix + the Driver/Native release grid:
- Probe finding: lem links DuckDB via cgo; duckdb-go-bindings is //go:build cgo, so
  CGO_ENABLED=0 fails for every target. There is NO pure-Go lem and NO free
  cross-compile — each cell is a native cgo build. duckdb supports darwin/{amd64,arm64},
  linux/{amd64,arm64}, windows/amd64 (NOT windows/arm64).
- GitHub now builds only the cpu cells it can build natively (macos aarch64 + x86_64,
  linux x86_64 + aarch64, windows x86_64); the dishonest hosted-metal cell is removed.
- Metal rides a self-hosted macOS 26 lane, dormant behind `if vars.ENABLE_MACOS_METAL`
  so it never queues or fails on a push; interim = built manually on the maintainer's Mac.
  Hosted runners are < macOS 26 and cannot compile the Metal 4 metallibs; a plain build
  would ship a non-runnable, metallib-less binary.
- Each cell is packaged twice from one build: Native {os}-{arch}-lem-{backend}-{ver}.zip
  (binary `lem`) and Driver {os}-{arch}-lem-driver-{backend}-{ver}.zip (binary
  `lem-{backend}`); rolling dev prerelease kept, version aligned to dev-<short-sha>.
- Dropped GOWORK=off from the binary build: cli pins go/inference v0.14.0 which lags the
  local tree (missing the dataset pkg), so the workspace must wire cli -> local go/.

docs/release-artifacts.md settles the grid, the two packagings, per-cell CI ownership,
the metal trade-off, the cgo finding, and the not-yet-wired follow-ups (tagged GitHub
release; GitLab grid-named zips — left for on-box validation).

.gitlab-ci.yml untouched (green; gates own WHEN). Makefile untouched. cli/tui untouched.

Co-Authored-By: Virgil <virgil@lethean.io>

Four failures, three platform-blind and one real fixture bug — all
reproduced and re-verified on the linux box (full portable suite
exit=0 there; agent/ai + driver 335 green on darwin):

- engine/metal gemm_steel_test.go had no build constraint — on linux
  the package collapsed to that one file and failed to build. Tagged
  darwin && arm64 like every sibling; linux now excludes the package
  cleanly.
- agent/ai TestReadEvents compared time.Time with != after a disk
  round-trip — passes only when the local zone makes time.Parse hand
  back time.Local (BST Macs), fails on UTC runners. Now .Equal.
- engine/hip: two contract tests carried pre-truth-pass expectations
  (standalone-native qwen3_6_moe, fitting 16GB plan). The truth-pass
  source (ArchitectureProfileNotes post-#50) is explicit: no native
  path replaced the retired composed detour. Realigned to
  metadata_only / Fits=false with the architecture gap reported
  honestly; the memory-plan maths assertions stay.
- engine/driver: fakeDriverScript ran a bare 'sleep' under the
  harness's deliberately EMPTIED PATH — exit 127 on spawn, every test
  driver an instant corpse, the crash-restart test racing its own
  restart storm (darwin's poll won the race; linux's never did).
  /bin/sleep by absolute path — the restart loop is now genuinely
  exercised on both platforms.

Co-Authored-By: Virgil <virgil@lethean.io>