ci: consolidate per-OS testing builds into one matrix workflow

Replaces linux/windows/macos-testing-build.yml with a single testing-build.yml
(matrix over ubuntu/windows/macos) that publishes all artifacts to one
0.0.0-testing-<sha> prerelease. Manual dispatch + 0.0.0-testing-* tag push.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/linux-testing-build.yml

@@ -1,68 +0,0 @@
-name: Linux testing build
-
-# Manual, Linux-only testing build. Click "Run workflow" in the Actions tab and it
-# builds the unsigned Linux desktop app, cuts a prerelease tagged
-# 0.0.0-testing-<short-sha> at the chosen commit, and attaches the .deb/.rpm.
-#
-# Linux only for now (no macOS/Windows, no signing). The .deb is the easiest thing
-# to hand someone: `sudo apt install ./Agent*.deb` then run `agent-orchestrator`;
-# the deb sets chrome-sandbox setuid root, so no --no-sandbox workaround is needed.
-#
-# The daemon is compiled natively on the ubuntu runner by build-daemon.mjs during
-# premake (host == target), so the bundled `ao` is a real Linux binary.
-
-on:
-  workflow_dispatch:
-  push:
-    tags:
-      - "0.0.0-testing-*"
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    defaults:
-      run:
-        working-directory: frontend
-    env:
-      # Pure-Go sqlite (modernc) needs no cgo; static daemon = portable across glibc.
-      CGO_ENABLED: 0
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: npm
-          cache-dependency-path: frontend/package-lock.json
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: backend/go.mod
-          cache-dependency-path: backend/go.sum
-      - run: npm ci
-      - name: Build Linux .deb (unsigned)
-        # deb only: the rpm maker can't find its tooling on the runner, and a .deb
-        # is all we need to hand someone. `npm run make` keeps the premake daemon
-        # build; --targets restricts to the deb maker.
-        run: npm run make -- --targets @electron-forge/maker-deb
-      - name: Publish to a 0.0.0-testing-<sha> prerelease
-        shell: bash
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          # Tag push: use the pushed tag. Manual run: mint 0.0.0-testing-<sha>.
-          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
-            TAG="${GITHUB_REF_NAME}"
-          else
-            TAG="0.0.0-testing-${GITHUB_SHA::7}"
-          fi
-          # Creates the tag at this commit if it does not exist; idempotent on re-run.
-          gh release create "$TAG" --prerelease --target "$GITHUB_SHA" --title "$TAG" \
-            --notes "Unsigned Linux testing build (.deb/.rpm). Not signed; for testing only." \
-            || true
-          # NUL-delimited to survive spaces in the app name ("Agent Orchestrator-...").
-          find out/make -type f -print0 | while IFS= read -r -d '' f; do
-            echo "uploading: $f"
-            gh release upload "$TAG" "$f" --clobber
-          done

.github/workflows/macos-testing-build.yml

@@ -1,69 +0,0 @@
-name: macOS testing build
-
-# Manual/tag macOS testing build. Click "Run workflow" in the Actions tab (or push a
-# 0.0.0-testing-* tag) and it builds the unsigned macOS app, cuts a prerelease tagged
-# 0.0.0-testing-<short-sha>, and attaches the .zip (the dmg maker is a follow-up).
-#
-# arm64 only: macos-latest runners are Apple Silicon, so this does not cover Intel.
-# Unsigned + not notarized: once downloaded the app is quarantined and Gatekeeper
-# blocks it. To open: right-click -> Open, or
-#   xattr -dr com.apple.quarantine "Agent Orchestrator.app"
-#
-# The daemon is compiled natively on the macOS runner by build-daemon.mjs during
-# premake (host == target), so the bundled ao is a real macOS arm64 binary.
-
-on:
-  workflow_dispatch:
-  push:
-    tags:
-      - "0.0.0-testing-*"
-
-jobs:
-  build:
-    runs-on: macos-latest
-    permissions:
-      contents: write
-    defaults:
-      run:
-        working-directory: frontend
-    env:
-      # Pure-Go sqlite (modernc) needs no cgo.
-      CGO_ENABLED: 0
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: npm
-          cache-dependency-path: frontend/package-lock.json
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: backend/go.mod
-          cache-dependency-path: backend/go.sum
-      - run: npm ci
-      - name: Build macOS app (unsigned)
-        # `npm run make` keeps the premake daemon build; --targets restricts to the
-        # zip maker (the only darwin maker configured today).
-        run: npm run make -- --targets @electron-forge/maker-zip
-      - name: Publish to a 0.0.0-testing-<sha> prerelease
-        shell: bash
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          # Tag push: use the pushed tag. Manual run: mint 0.0.0-testing-<sha>.
-          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
-            TAG="${GITHUB_REF_NAME}"
-          else
-            TAG="0.0.0-testing-${GITHUB_SHA::7}"
-          fi
-          # Creates the tag at this commit if it does not exist; idempotent on re-run.
-          # Shared with the Linux/Windows jobs on a tag push: distinct asset names, --clobber.
-          gh release create "$TAG" --prerelease --target "$GITHUB_SHA" --title "$TAG" \
-            --notes "Unsigned testing build. Not signed; for testing only." \
-            || true
-          # NUL-delimited to survive spaces in the app name ("Agent Orchestrator-...").
-          find out/make -type f -print0 | while IFS= read -r -d '' f; do
-            echo "uploading: $f"
-            gh release upload "$TAG" "$f" --clobber
-          done

.github/workflows/testing-build.yml

@@ -0,0 +1,83 @@
+name: Testing build (all platforms)
+
+# Unsigned testing builds for Linux + Windows + macOS in one matrix. Click
+# "Run workflow" in the Actions tab, or push a 0.0.0-testing-* tag. All three jobs
+# publish to a single 0.0.0-testing-<short-sha> prerelease (distinct asset names).
+#
+# Per OS:
+#   Linux   -> .deb
+#   Windows -> Setup.exe (+ .nupkg / RELEASES)
+#   macOS   -> .zip (arm64; dmg + signing are follow-ups)
+#
+# Unsigned: macOS is quarantined/Gatekeeper-blocked once downloaded
+# (xattr -dr com.apple.quarantine "Agent Orchestrator.app"); Windows SmartScreen
+# warns ("More info" -> "Run anyway"). Each OS builds on its own native runner so
+# build-daemon.mjs compiles the bundled ao for that platform (host == target).
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "0.0.0-testing-*"
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: "@electron-forge/maker-deb"
+          - os: windows-latest
+            target: "@electron-forge/maker-squirrel"
+          - os: macos-latest
+            target: "@electron-forge/maker-zip"
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: write
+    defaults:
+      run:
+        working-directory: frontend
+    env:
+      # Pure-Go sqlite (modernc) needs no cgo; on Linux this also keeps the daemon
+      # static and portable across glibc.
+      CGO_ENABLED: 0
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: backend/go.mod
+          cache-dependency-path: backend/go.sum
+      - run: npm ci
+      - name: Build (unsigned)
+        # `npm run make` keeps the premake daemon build; --targets restricts to this
+        # platform's maker.
+        run: npm run make -- --targets ${{ matrix.target }}
+      - name: Publish to a 0.0.0-testing-<sha> prerelease
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          # Tag push: use the pushed tag. Manual run: mint 0.0.0-testing-<sha>.
+          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
+            TAG="${GITHUB_REF_NAME}"
+          else
+            TAG="0.0.0-testing-${GITHUB_SHA::7}"
+          fi
+          # Matrix jobs race here; first one creates the release, the rest hit
+          # "already exists" which is fine (|| true). Distinct asset names + --clobber
+          # make uploads idempotent across re-runs.
+          gh release create "$TAG" --prerelease --target "$GITHUB_SHA" --title "$TAG" \
+            --notes "Unsigned testing build (Linux .deb / Windows Setup.exe / macOS .zip). Not signed; for testing only." \
+            || true
+          # NUL-delimited to survive spaces in the app name ("Agent Orchestrator-...").
+          find out/make -type f -print0 | while IFS= read -r -d '' f; do
+            echo "uploading: $f"
+            gh release upload "$TAG" "$f" --clobber
+          done

.github/workflows/windows-testing-build.yml

@@ -1,68 +0,0 @@
-name: Windows testing build
-
-# Manual/tag Windows testing build. Click "Run workflow" in the Actions tab (or push
-# a 0.0.0-testing-* tag) and it builds the unsigned Windows desktop app via the
-# Squirrel maker, cuts a prerelease tagged 0.0.0-testing-<short-sha>, and attaches
-# the Setup.exe (+ .nupkg / RELEASES).
-#
-# Unsigned: Windows SmartScreen will warn on first run ("More info" -> "Run anyway").
-# Code signing is a follow-up.
-#
-# The daemon is compiled natively on the windows runner by build-daemon.mjs during
-# premake (host == target), so the bundled ao.exe is a real Windows binary.
-
-on:
-  workflow_dispatch:
-  push:
-    tags:
-      - "0.0.0-testing-*"
-
-jobs:
-  build:
-    runs-on: windows-latest
-    permissions:
-      contents: write
-    defaults:
-      run:
-        working-directory: frontend
-    env:
-      # Pure-Go sqlite (modernc) needs no cgo.
-      CGO_ENABLED: 0
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: npm
-          cache-dependency-path: frontend/package-lock.json
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: backend/go.mod
-          cache-dependency-path: backend/go.sum
-      - run: npm ci
-      - name: Build Windows installer (unsigned)
-        # `npm run make` keeps the premake daemon build; --targets restricts to the
-        # Squirrel maker (Setup.exe + .nupkg + RELEASES).
-        run: npm run make -- --targets @electron-forge/maker-squirrel
-      - name: Publish to a 0.0.0-testing-<sha> prerelease
-        shell: bash
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          # Tag push: use the pushed tag. Manual run: mint 0.0.0-testing-<sha>.
-          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
-            TAG="${GITHUB_REF_NAME}"
-          else
-            TAG="0.0.0-testing-${GITHUB_SHA::7}"
-          fi
-          # Creates the tag at this commit if it does not exist; idempotent on re-run.
-          # Shared with the Linux job on a tag push: distinct asset names, --clobber.
-          gh release create "$TAG" --prerelease --target "$GITHUB_SHA" --title "$TAG" \
-            --notes "Unsigned testing build. Not signed; for testing only." \
-            || true
-          # NUL-delimited to survive spaces in the app name ("Agent Orchestrator-...").
-          find out/make -type f -print0 | while IFS= read -r -d '' f; do
-            echo "uploading: $f"
-            gh release upload "$TAG" "$f" --clobber
-          done