ci: cross-repo fresh-shell PATH-persistence guard for install.sh

[LukasWodka]

Part of #737

Summary

Adds a thin, label-gated CI job that catches a PATH-persistence regression in this repo's scripts/install.sh from the CLI side, pre-merge — instead of only after a release. This is the gap that let the original PATH issue ship green: no test opened a fresh shell after install and asserted tracebloc was reachable. A fresh non-login bash reads ~/.bashrc, not ~/.profile / ~/.bash_profile, so an installer that persists PATH to the wrong file looks fine in the install shell but breaks in a new terminal.

What changed

New workflow .github/workflows/install-path-persist.yml. It does not re-implement the check — the fresh-shell harness lives in tracebloc/client (scripts/tests/path-persist.sh) as the single source of truth (added in tracebloc/client#214). This job:

1. Checks out this CLI PR (actions/checkout, path: cli).
2. Checks out the client harness (actions/checkout with repository: tracebloc/client, path: client).
3. Runs the harness in a fresh container per distro with TRACEBLOC_CLI_REF=/src/cli/scripts/install.sh — a local file path, so the harness installs this PR's install.sh (not the released one) and then asserts tracebloc resolves + tracebloc version runs from a fresh login and non-login shell for each of bash / zsh / fish.

Distro slice: ubuntu:24.04, debian:12, fedora:latest, opensuse/leap:15.6 (apt / dnf / zypper init families) — a representative subset; the full distro x shell x mode matrix runs in the client repo.

How it's triggered

Mirrors this repo's e2e.yml gating to control cost:

• nightly schedule
• workflow_dispatch
• on a PR only when it carries the e2e label (contains(github.event.pull_request.labels.*.name, 'e2e')), and only when scripts/install.sh or this workflow change.

Refs

• Part of tracebloc/backend#737 (keystone cross-repo last-mile E2E)
• Consumes the harness from test: cross-repo fresh-shell last-mile E2E harness (install -> CLI -> cluster info -> push) client#214
• The client harness ref is currently pinned to its feature branch via the CLIENT_HARNESS_REF env var, with a TODO(client#214) to switch to develop once that PR merges (the harness doesn't exist on client's develop yet).

Verified locally / Needs CI

Verified locally (green):

• yaml.safe_load on the workflow — parses.
• actionlint on the workflow — clean.

Needs CI (requires GitHub runners / Docker — not run locally):

• The actual cross-repo run (checkout of tracebloc/client + per-distro containers). It also depends on the harness branch being reachable; once client#214 merges, flip CLIENT_HARNESS_REF to develop.
• To exercise it on this PR, add the e2e label.

---

Note

Low Risk
CI-only addition with read-only checkouts; no runtime or installer logic changes in this diff.

Overview
Adds .github/workflows/install-path-persist.yml, a pre-merge CI guard so regressions in scripts/install.sh PATH persistence fail before merge (fresh terminals can’t find tracebloc).

The workflow mirrors e2e.yml triggers: nightly schedule, workflow_dispatch, and PRs only with the e2e label when scripts/install.sh or this workflow changes. It checks out this repo’s PR tree and tracebloc/client at CLIENT_HARNESS_REF: develop, then runs client/scripts/tests/path-persist.sh in Docker across four distros with TRACEBLOC_CLI_REF=/src/cli/scripts/install.sh so the harness exercises this PR’s installer, not a released build.

^{Reviewed by Cursor Bugbot for commit b48f9bd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 17 / 8

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#102 — chore(kanban): declare staging as prod-truth branch via .kanban.yml · author: @LukasWodka · no reviewer assigned
• averaging-service#103 — fix(averaging): correctness foundations — DP, shape guard, sklearn weighting, bounded ensembles (dataset push: tabular pre-flight silently collapses duplicate header columns and accepts zero-data-row CSVs #73) · author: @LukasWodka · reviewer: @shujaatTracebloc
• averaging-service#98 — ci: add fr-gate caller workflow · author: @LukasWodka · no reviewer assigned
• backend#732 — feat(experiments): add per-experiment aggregation_strategy field (#730) · author: @LukasWodka · reviewer: @saqlainsyed007, @shujaatTracebloc
• backend#735 — fix(flops): atomic flops_used + fire stop once on threshold crossing (#733) · author: @saadqbal · no reviewer assigned
• cli#61 — fix(install.sh): persist PATH to the shell rc (parity with install.ps1) · author: @LukasWodka · reviewer: @saadqbal
• client#207 — test(charts): add helm-unittest suite for ingestion-authz-configmap · author: @saadqbal · no reviewer assigned
• client#211 — fix(installer): bound the apt dpkg-lock wait so a held lock can't hang the install (feat(data ingest): confirm the inferred tabular schema (#185) #210) · author: @saadqbal · no reviewer assigned
• data-ingestors#146 — test(schema): lock category enum to the engine's TaskCategory (anti-drift) · author: @LukasWodka · reviewer: @saadqbal
• data-ingestors#148 — Develop to prod · author: @divyasinghds · reviewer: @saadqbal

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[LukasWodka]

Board hygiene 2026-07-07 (Lukas + Claude): reviewed against the current direction — still valid, not superseded (the cross-repo fresh-shell PATH guard is orthogonal to Rev 8/9 and arguably more valuable now that the installer also drops a tb symlink that should resolve in fresh shells too). Needs: a rebase (a month of installer churn incl. cli#142's tb alias — worth asserting tb version as well) and an un-draft decision. Keeping open.

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit bb35efa. Configure here.}

[LukasWodka]

@BugBot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b48f9bd. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 43 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#182 — feat(weights): averaging writes SafeTensors (TF + PyTorch) — SEC-03 §8 step 4 · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#183 — docs: SafeTensors deployment-order & resume-safety runbook (epic feat(auth): logout revokes the token server-side (cli#112) #116) · author: @shujaatTracebloc · reviewer: @saadqbal
• backend#1093 — chore(deps): bump django from 5.2.14 to 5.2.15 · author: @dependabot · no reviewer assigned
• backend#1108 — test(api): CLI response-shape contract fixtures for the 9 CLI endpoints (WS-D.2) · author: @LukasWodka · reviewer: @saadqbal
• backend#1111 — feat(download): edge weights fetch tolerates .safetensors (SEC-03 step 5c hardening) · author: @shujaatTracebloc · reviewer: @saadqbal
• backend#1112 — fix(runners): migrate deprecated trainingClasses/getTrainingPlan to snake_case (#1102) · author: @LukasWodka · reviewer: @saqlainsyed007
• backend#1114 — perf(leaderboard): serializer prefetch reads + TeamSerializer is_* in Python (#978 pt2) · author: @aptracebloc · reviewer: @saqlainsyed007
• cli#302 — ci: re-enable staticcheck (pinned standalone) + fix the 5 non-ST1005 findings · author: @LukasWodka · no reviewer assigned
• client#345 — main -> Enhance installer with pre-flight checks, user feedback, and digest pinning · author: @saadqbal · no reviewer assigned
• client#351 — fix(installer): bound services progress-bar kubectl with --request-timeout · author: @saadqbal · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)