ci: add --no-default-features build+test job for ephapax-cli

Keeps the dep-free build green automatically. Proves the
`typed-wasm-verify` feature flag introduced in this PR is genuinely
optional: ephapax-cli builds + tests with zero git dep on
`hyperpolymath/typed-wasm`. The job runs in parallel with the
default-features `check`/`test` jobs (gated by the same
`needs: check` for fmt + clippy ordering).

Scoped to `-p ephapax-cli` deliberately rather than
`--workspace --no-default-features` because `ephapax-runtime`
carries an unrelated default-feature (panic-handler) that
unconditionally fails at workspace scope. The `typed-wasm-verify`
feature only lives on `ephapax-cli`, so per-crate scope is precise.

Locally verified: `cargo test -p ephapax-cli --no-default-features`
→ 13/13 passing (verifier integration tests cfg-skipped; the
absence-of-verifier-output test still asserts no verifier ran).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/rust-ci.yml

@@ -68,6 +68,44 @@ jobs:
           echo "- **cargo check**: passed" >> "$GITHUB_STEP_SUMMARY"
           echo "- **cargo test**: completed" >> "$GITHUB_STEP_SUMMARY"
 
+  no-default-features:
+    name: Cargo build + test (ephapax-cli, --no-default-features)
+    runs-on: ubuntu-latest
+    needs: check
+    if: hashFiles('Cargo.toml') != ''
+
+    # Proves ephapax can be built and tested with zero git dep on the
+    # sibling `hyperpolymath/typed-wasm` repo. Enforces the estate
+    # architectural rule that typed-wasm must be removable from either
+    # language with no impact. See `src/ephapax-wasm/src/ownership.rs`
+    # for the in-tree codec that makes this possible.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
+
+      - name: Cache cargo registry and build
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2
+        with:
+          key: no-default-features
+
+      - name: Cargo build -p ephapax-cli --no-default-features
+        run: cargo build -p ephapax-cli --no-default-features
+
+      - name: Cargo test -p ephapax-cli --no-default-features
+        run: cargo test -p ephapax-cli --no-default-features
+
+      - name: Write summary
+        if: always()
+        run: |
+          echo "## --no-default-features build" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "Proves the typed-wasm-verify feature is genuinely optional:" >> "$GITHUB_STEP_SUMMARY"
+          echo "ephapax-cli builds + tests with zero git dep on the" >> "$GITHUB_STEP_SUMMARY"
+          echo "hyperpolymath/typed-wasm repo." >> "$GITHUB_STEP_SUMMARY"
+
   status-gate:
     name: Status gate
     runs-on: ubuntu-latest