test.yaml: drop the cygheap-fork diagnostic split (per-task pwsh +
bash xtrace probes that traced the issue to mise.cmd's self-recursive
shim, a fix that landed upstream), the TEMPORARY MISE_ENV bisect
comment, MISE_VERBOSE/MISE_DEBUG, and the narrowed-to-ubuntu+windows
PR matrix. Restore the canonical 4-OS PR matrix (ubuntu-latest +
ubuntu-24.04-arm + macos-latest + windows-latest). Keep the
busybox-as-default-shell conditional on Windows -- it remains the
documented workaround for Git Bash's MSYS fork-copy on these runners,
even after the shim fix.

upstream-cache.yaml: drop 3 redundant `shell: bash` overrides on the
dart-typegen job, switch the msys2 install package list from `>-` to
`|-` (no semantic change, satisfies gha-no-folded-strip), and rewrite
8 trailing-backslash shell continuations into shell-variable
assemblies (no-trailing-backslash policy).

docker-windows.yaml: restore the full nanoserver+servercore on each
of windows-2022+windows-2025 matrix.

ast-grep + conftest gha rules: add two carve-outs the cleanup needs.
`name:` prefix `Setup:` (pre-mise bootstrap that can't yet use the
job's mise-managed default shell -- e.g. the `Setup: HOME =
USERPROFILE on Windows` step which runs BEFORE mise itself is
installed), and `shell: msys2 {0}` for steps that need msys2's
MINGW64 env (augeas Windows build). gha-no-folded-strip also gets a
positive carve-out for `shell: $VAL` block scalars so the multi-line
ternary for the busybox/bash default-shell selector parses.

Formatter-applied side-effects from running the check sweep: taplo
key-order normalization in config.toml + config.windows.toml +
data.toml, dprint renumbering a list in CLAUDE.md, and cargo-fmt
folding a 1-line #[expect] in api_modules.rs.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

On Windows the previous form `{{ vars.mise_data_dir }}/installs/...`
rendered to `C:/Users/runneradmin/.local/share/mise/installs/...`
because:

  - mise itself uses %LOCALAPPDATA%\mise on Windows (not
    $HOME/.local/share/mise), so the tarball was installed at
    C:\Users\runneradmin\AppData\Local\mise\installs\http-rp-wasm\08a1d6f
  - but vars.mise_data_dir is templated from MISE_DATA_DIR (unset on
    Windows GHA) with a $HOME-based default, which the workflow's
    "Setup: HOME = USERPROFILE" step sets to C:\Users\runneradmin,
    giving the wrong path.

build-ws-pywasm1-module then failed with `cp: The system cannot find
the path specified. (os error 3)` (job 82468776315 on PR 63 / commit
af585b8). Fix: render rp_wasm_dir against vars.mise_installs on
Windows and vars.mise_data_dir on Unix. Same OS-conditional pattern
the JAVA_HOME and MVN vars already use.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Previous fix referenced `vars.mise_installs` in config.toml's [vars]
block, but mise renders config.toml [vars] before config.<os>.toml
[vars] is in scope -- the Windows lane then errored with `Variable
vars.mise_installs not found in context while rendering
'__tera_one_off'` and failed `mise run preinstall` (job
82470049137 on PR 63 / commit c0d068b).

Inline `get_env(name="LOCALAPPDATA")` on the Windows branch and
`get_env(name="MISE_DATA_DIR", default=$HOME...)` on the Unix branch
so the var is self-contained -- same pattern vars.mise_data_dir
itself already uses.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Multiple small cleanups now that CI is green, plus probe steps that
answer "is the Pre-mise HOME = USERPROFILE step actually needed."

Rip out recur. Its disablement was a panic move during the Windows
cmd-subprocess setlocal-recursion bisect; the actual fix landed
upstream (mise.cmd self-recursive shim). Across recur's brief life
in this repo it consumed weeks of debugging and has zero documented
saves. The dominant fetch-failure mode for our prefetch path is GH
rate-limit, which recur's 25-min retry budget can't outwait anyway.
Removes the [tools] entry, the {{ vars.retry }} wrapper on 8 call
sites, the eager _setup_all install, the mise.rego rule that enforced
the wrapper, and the long Windows-cmd recursion comments. CLAUDE.md
gains a "Fetch resilience: prefer upstream-cache, not retry wrappers"
section explaining the rationale and pointing at the cache pattern as
the preferred resilience strategy.

Drop the `diagnostic_test_mise_env` carve-out from gha.rego. It
allowed the test workflow to narrow MISE_ENV during the cygheap
bisect; the bisect ended at the canonical dart,dotnet,java,js,python,
rust,zig set and the carve-out has no consumer.

Drop the `Diagnostic:` step-name carve-out from gha-no-step-shell
(both ast-grep and conftest). It was the escape hatch for the
short-lived probe steps that found the mise.cmd shim recursion;
those probes are gone.

Rename the surviving carve-out from `Setup:` to `Pre-mise:` (more
semantically specific). One consumer: the
`Pre-mise: HOME = USERPROFILE on Windows` step in test.yaml.

Trim the install-mise-tools/action.yaml step comment about the
self-recursive mise.cmd shim; the captured shim contents, propagation
chain, run URL + commit SHA, and "belt-and-braces" rationale moved
into OLD_NOTES.md's existing cygheap section (uncommitted).

Add empirical probe steps:
  - test.yaml `Pre-mise: probe HOME on Windows`: prints HOME/USERPROFILE
    from both Git Bash and cmd.exe before the Pre-mise HOME step, so a
    single CI run answers whether GHA's windows-latest VM populates
    HOME by default. cmd's behavior of leaving `%HOME%` literal when
    the var is unset makes the signal unambiguous.
  - Dockerfile.windows: a `RUN echo before-env: HOME=[%HOME%]
    USERPROFILE=[%USERPROFILE%]` step before the existing `ENV
    HOME=...`. Counterpart to the test.yaml probe; captures the Server
    Core container base-image state vs the GHA VM state.

Both probes self-document their removal-once-captured intent.
Dockerfile.nanoserver already has an equivalent (after-ENV) check
that proves Nano leaves HOME unset by failing if `%HOME%` doesn't
exist.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

… verify

A new local composite action at .github/actions/free-disk-space-windows
removes safely-unused preinstalled software (Android SDK, old Python /
JDK / .NET SDK versions, misc DB SDKs) from the GHA Windows runner's
C:\ before docker work. Counterpart to jlumbroso/free-disk-space on
Linux, which has no Windows path. All five categories are individual
inputs defaulting to true so callers can opt out per category. Steps
run under Git Bash with `/c/...` paths (no PowerShell) so they
satisfy the new gha_action shell-policy below.

Wired into both docker-windows.yaml (before the existing
docker-prune cleanup) and test.yaml (after the Linux jlumbroso step,
gated on `if: runner.os == 'Windows'`).

New conftest policy at config/conftest/policy/gha_action/gha_action.rego:
composite-action `run:` steps must use shell `bash --noprofile --norc
-euo pipefail {0}` exactly (matching the workflow `defaults.run.shell`
invariant in the existing gha rule). All three composite actions
(install-mise, install-mise-tools, free-disk-space-windows) migrated
to the explicit form. The conftest-check-yaml task gains a third pass
to enforce the rule across `.github/actions/*/action.yaml`.

Audit of other workflow-only tooling and extension to actions:
- action-validator: now validates both
- zizmor: now scans both; the github-env false positive on
  install-mise's deterministic $GITHUB_PATH append is suppressed via
  inline `# zizmor: ignore[github-env]` (config-file ignore doesn't
  work for composite actions per zizmor docs)
- ast-grep gha-no-folded-strip: extended to actions; gained a
  `description:` carve-out (action.yaml description fields ARE long
  folded paragraphs by design)
- Other gha-* ast-grep rules stay workflow-only (job/strategy/
  concurrency are workflow shape; not relevant to actions)

CI temporarily narrowed: check.yaml, dependencies.yaml,
docker-linux.yaml, docker-windows.yaml all parked with `if: false`;
test.yaml PR matrix narrowed to windows-latest only. Drop the
TEMPORARY blocks (4 file-pairs total) and restore test.yaml's
4-OS PR matrix once the new action is confirmed to free disk space
as expected on a real CI run.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>