ci+fix: opt into --workspace --lib + detached-HEAD branch fallback (PMAT-159)

.github/workflows/ci.yml

@@ -31,13 +31,24 @@ jobs:
       # Highest expected sccache hit-rate lift — the signal that justifies
       # fleet-wide rollout (or shelves it).
       #
-      # 2026-04-19: temporarily disabled — sovereign-ci:stable container image
-      # is missing the `rustc-sccache` wrapper script, so every sccache-gated
-      # job fails at toolchain probe ("No such file or directory"). Re-enable
-      # once paiml/.github runner image ships the wrapper again (tracked in
-      # paiml/.github infra issue — not this repo).
-      enable_sccache: false
+      # 2026-04-21 (PMAT-159 canary): re-enabled. The `rustc-sccache` exec-script
+      # shim ships in sovereign-ci:stable since paiml/infra#66 (2026-04-19); the
+      # stale "missing wrapper" disablement has been lifted. Diagnostic: with
+      # `test_workspace: true` the 60-min ceiling binds without a warm cache
+      # (ci/test + ci/coverage both timed out on run 24685501433).
+      enable_sccache: true
       use_nextest: true
+      # PMAT-159 decision (2026-04-21): NOT opting into test_workspace here.
+      # Rationale: aprender's bespoke `workspace-test` job below is the trusted
+      # test signal for APR-MONO and runs the same workload. Dual execution
+      # doubles compile work on one host (jobserver oversubscription — cargo
+      # #12912). F11 is overridden per-repo to measure `workspace-test` for
+      # aprender instead of `ci / test`; see infra examples/falsify_f11_test_job_p95.rs
+      # and docs/specifications/build-performance.md §7 Phase 2.4.
+      #
+      # ci/test here reverts to `cargo nextest run --lib` on the root stub
+      # (0 tests, green). It is intentionally kept as a gate presence so the
+      # org ruleset's `ci / gate` context stays populated.
     secrets: inherit
 
   # APR-MONO: Workspace-wide test (all 75 crates)

crates/aprender-orchestrate/src/oracle/local_workspace.rs

@@ -381,6 +381,22 @@ impl LocalWorkspaceOracle {
             .and_then(|o| String::from_utf8(o.stdout).ok())
             .map(|s| s.trim().to_string())
             .unwrap_or_else(|| "unknown".to_string());
+        // Detached HEAD (common in CI `actions/checkout`) makes `branch --show-current`
+        // emit an empty string. Fall back to the short SHA so downstream consumers and
+        // assertions like `!branch.is_empty()` stay meaningful.
+        let branch = if branch.is_empty() {
+            Command::new("git")
+                .args(["rev-parse", "--short", "HEAD"])
+                .current_dir(path)
+                .output()
+                .ok()
+                .and_then(|o| String::from_utf8(o.stdout).ok())
+                .map(|s| format!("HEAD@{}", s.trim()))
+                .filter(|s| s != "HEAD@")
+                .unwrap_or_else(|| "unknown".to_string())
+        } else {
+            branch
+        };
 
         let status_output = Command::new("git")
             .args(["status", "--porcelain"])