ci: consolidate and parallelize the test suite

[bifrost0x]

Summary

• reduce authentication-heavy pytest runtime with a pytest-only bcrypt work factor while preserving a subprocess contract for the production cost
• run the Python suite with two load-scope workers, keep disposable integrations in their dedicated jobs, and execute only the real Redis probe against Redis 7 and 8
• split Playwright into two isolated, test-level shards while running vendor and JavaScript checks once
• run AMD64 and ARM64 image security jobs in parallel, share their architecture caches with publishing, and skip the redundant non-publishing multi-architecture build on pull requests
• preserve Dependabot vendor recovery and add CI policy contracts for the consolidated layout

Validation

• 2278 passed, 2 skipped in 157.03s with a fresh environment installed from the hash lock
• Playwright shard 1: 50 passed in 2.7m
• Playwright shard 2: 50 passed in 2.8m
• 34 JavaScript test files passed
• 10 vendored frontend assets verified
• 37 focused hashing, supply-chain, and Dependabot policy tests passed after the final workflow cleanup
• requirements-test.txt reproduced byte-for-byte with the CI-pinned uv 0.12.3
• all workflow YAML parsed successfully and git diff --check passed

Expected impact

• local Python wall time decreased from 8:12 to 2:37 without removing functional coverage
• the slower browser shard completes in about 2:48 instead of the current 6:32 Playwright step
• pull requests no longer repeat the multi-architecture image build after both scan candidates have already been built

Production bcrypt behavior is unchanged. The isolated production contract performs a real hash and verification and asserts the current cost factor of 12.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T09:07:01.095580Z	05c244b	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[bifrost0x]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: a4fbd4a59d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[bifrost0x]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 05c244bab1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".