fix(ci): gate rust/elixir reusables via a detect job, not inputs in job-if

rust-ci-reusable.yml and elixir-ci-reusable.yml put
`hashFiles(format('{0}/<manifest>', inputs.working_directory)) != ''`
directly in each job-level `if:`. That startup-failed the reusable on every
push (run with 0 jobs): the `inputs` context does not exist when GitHub
compiles a workflow for a non-workflow_call event, so the expression is
invalid. (It was also latently broken when *called* — `hashFiles` at job
level runs before any checkout, so it reads an empty workspace.)

Replace with the canonical pattern: a small `detect` job checks out first,
resolves `has_cargo`/`has_mix` (and the enable_audit/enable_coverage toggles
for Rust) into step outputs, and every downstream job gates on
`needs.detect.outputs.*` — valid in every event context and actually sees the
files. No existing job names change, so consumer status-check names are
unaffected.

This is an estate-consumed template change (separate commit for independent
review). Validated with PyYAML. No SPDX header or licence content touched.

https://claude.ai/code/session_011xv3VLrqeXkpjXxUojKz82

Author: claude

.github/workflows/elixir-ci-reusable.yml

@@ -98,12 +98,39 @@ permissions:
   contents: read
 
 jobs:
+  # Detect mix.exs AFTER checkout and gate the test job on this job's output.
+  # Putting `hashFiles(... inputs.working_directory)` directly in the job-level
+  # `if:` startup-failed the reusable on every push: the `inputs` context does
+  # not exist when GitHub compiles a workflow for a non-`workflow_call` event,
+  # and `hashFiles` at job level (pre-checkout) reads an empty workspace.
+  # Gating on `needs` is the canonical, event-context-safe pattern.
+  detect:
+    timeout-minutes: 5
+    name: Detect Mix project
+    runs-on: ${{ inputs.runs-on }}
+    permissions:
+      contents: read
+    outputs:
+      has_mix: ${{ steps.d.outputs.has_mix }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: ${{ github.repository }}
+          ref: ${{ github.ref }}
+      - id: d
+        working-directory: ${{ inputs.working_directory }}
+        run: |
+          has=false; [ -f mix.exs ] && has=true
+          echo "has_mix=$has" >> "$GITHUB_OUTPUT"
+
   test:
     timeout-minutes: 20
     name: Compile + test
     runs-on: ${{ inputs.runs-on }}
+    needs: detect
     # Guard on mix.exs so the wrapper is safe to add unconditionally.
-    if: ${{ hashFiles(format('{0}/mix.exs', inputs.working_directory)) != '' }}
+    if: ${{ needs.detect.outputs.has_mix == 'true' }}
     permissions:
       contents: read
     env:

.github/workflows/rust-ci-reusable.yml

@@ -100,14 +100,48 @@ permissions:
   contents: read
 
 jobs:
-  # Skip the whole reusable when the repo has no Cargo.toml — lets
-  # consumers add the wrapper unconditionally without worrying about
-  # repos that don't ship Rust code at the moment.
+  # Detect whether the repo ships a Cargo.toml (and resolve the opt-in
+  # toggles) AFTER checkout, then gate every downstream job on this job's
+  # outputs. The previous design put `hashFiles(... inputs.working_directory)`
+  # directly in each job-level `if:`. That startup-failed the whole reusable
+  # on every push: the `inputs` context does not exist when GitHub compiles a
+  # workflow for a non-`workflow_call` event, and `hashFiles` at job level
+  # (pre-checkout) reads an empty workspace anyway. Gating on `needs` instead
+  # is the canonical pattern — valid in every event context, and it actually
+  # sees the files because detect checks out first.
+  detect:
+    timeout-minutes: 5
+    name: Detect Cargo project
+    runs-on: ${{ inputs.runs-on }}
+    permissions:
+      contents: read
+    outputs:
+      has_cargo: ${{ steps.d.outputs.has_cargo }}
+      run_audit: ${{ steps.d.outputs.run_audit }}
+      run_coverage: ${{ steps.d.outputs.run_coverage }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: ${{ github.repository }}
+          ref: ${{ github.ref }}
+      - id: d
+        working-directory: ${{ inputs.working_directory }}
+        env:
+          ENABLE_AUDIT: ${{ inputs.enable_audit }}
+          ENABLE_COVERAGE: ${{ inputs.enable_coverage }}
+        run: |
+          has=false; [ -f Cargo.toml ] && has=true
+          echo "has_cargo=$has" >> "$GITHUB_OUTPUT"
+          { [ "$has" = true ] && [ "$ENABLE_AUDIT" = "true" ]; } && echo "run_audit=true" >> "$GITHUB_OUTPUT" || echo "run_audit=false" >> "$GITHUB_OUTPUT"
+          { [ "$has" = true ] && [ "$ENABLE_COVERAGE" = "true" ]; } && echo "run_coverage=true" >> "$GITHUB_OUTPUT" || echo "run_coverage=false" >> "$GITHUB_OUTPUT"
+
   check:
     timeout-minutes: 20
     name: Cargo check + clippy + fmt
     runs-on: ${{ inputs.runs-on }}
-    if: ${{ hashFiles(format('{0}/Cargo.toml', inputs.working_directory)) != '' }}
+    needs: detect
+    if: ${{ needs.detect.outputs.has_cargo == 'true' }}
     permissions:
       contents: read
     defaults:
@@ -147,8 +181,8 @@ jobs:
     timeout-minutes: 20
     name: Cargo test
     runs-on: ${{ inputs.runs-on }}
-    needs: check
-    if: ${{ hashFiles(format('{0}/Cargo.toml', inputs.working_directory)) != '' }}
+    needs: [detect, check]
+    if: ${{ needs.detect.outputs.has_cargo == 'true' }}
     permissions:
       contents: read
     defaults:
@@ -187,7 +221,8 @@ jobs:
     timeout-minutes: 20
     name: Cargo audit (security)
     runs-on: ${{ inputs.runs-on }}
-    if: ${{ inputs.enable_audit && hashFiles(format('{0}/Cargo.toml', inputs.working_directory)) != '' }}
+    needs: detect
+    if: ${{ needs.detect.outputs.run_audit == 'true' }}
     permissions:
       contents: read
     defaults:
@@ -216,7 +251,8 @@ jobs:
     timeout-minutes: 20
     name: Coverage (tarpaulin + codecov)
     runs-on: ${{ inputs.runs-on }}
-    if: ${{ inputs.enable_coverage && hashFiles(format('{0}/Cargo.toml', inputs.working_directory)) != '' }}
+    needs: detect
+    if: ${{ needs.detect.outputs.run_coverage == 'true' }}
     permissions:
       contents: read
     defaults: