CI performance, resilience & prebuilt distribution

[Cro22]

Five opt-in improvements aimed at CI adoption and lower resource use. None change default behavior. Two commits:

1. CI perf & resilience (b5bf69d)

• Parallel scenario runner — augur run -concurrency N (alias -j N) runs agent invocations in parallel through the in-process proxy. Per-invocation stdout/stderr is buffered and flushed as a block (no interleaving); the Summary is assembled in deterministic task order. Defaults to 1 (the original sequential path is untouched). Proxy state, trace writer and cassette are already mutex-guarded.
• Dynamic proxy timeout — replaces the hardcoded 10-minute client timeout with a per-request context deadline (-timeout on run/proxy), overridable per call via the X-Augur-Timeout header for slow reasoning models (o1/o3/r1). Deriving the deadline from the inbound request context keeps client cancellation propagating to the upstream call (no orphaned tokens). -timeout 0 disables it.
• Opt-in model-alias fallback — --normalize-models on aggregate/gate prices a model absent from the snapshot via its longest dash-delimited prefix (gpt-4o-2024-08-06 → gpt-4o), with a dash-boundary rule so a base name can't swallow an unrelated one. Off by default (an un-priced call is still a hard ErrUnknownModel); every fallback is surfaced in Result.ModelAliases and warned to stderr, so it's never silent.

2. Prebuilt distribution (a7fef9d)

• GoReleaser cross-compiles linux/darwin/windows × amd64/arm64 (static, CGO off) and publishes augur_<os>_<arch>.tar.gz + checksums.txt to a GitHub release per v* tag. Build metadata is injected via -ldflags.
• augur version reports the injected build info (from-source builds say dev).
• Zero-toolchain Action — action.yml now downloads the release binary matching the pinned tag (github.action_ref) and runner os/arch, sha256-verifies it, and extracts it — so Python/TS/Node agent repos run the gate without a Go toolchain. Transparent source-build fallback for branch/SHA pins, unbuilt platforms, or download failures; new version input forces a tag or source.
• Release workflow (release.yml) on v* tags; CI gains a goreleaser-check job validating the config on every push.

Not included (from the original proposal)

Deliberately skipped with rationale: context-cancellation propagation was already implemented (proxy.go used NewRequestWithContext(r.Context())); the io.ReadAll→LimitReader streaming-hash idea rests on an inaccurate premise (the body must be buffered in full to forward and record it); internal/ restructure and OpenTelemetry ingest are larger, lower-ROI items left for follow-ups.

Verification

• Full go test ./... green; new tests for runner concurrency (real overlap, ordering, non-interleaved output, abort/continue-on-error), proxy timeout (fires, header override, header stripped), cost.Resolve (exact/fallback/longest-match/dash-boundary), aggregate alias surfacing, and the version command.
• Action download/checksum/os-arch/version-resolution logic simulated locally (valid + corrupt archive, binary- and two-space checksum formats, tag/branch/source refs). GoReleaser config is schema-checked in CI.

🤖 Generated with Claude Code