Qualify hosted fork CI with Linux package shards

.github/actions/build-bazel-package-binaries/action.yml

@@ -1,6 +1,10 @@
 name: Build Bazel package binaries
 description: Set up Bazel and stage unstripped runtime package binaries and symbols.
 inputs:
+  remote-credentials:
+    description: Boolean credential availability; callers must explicitly report whether their Bazel credential is configured.
+    required: false
+    default: "false"
   target:
     description: Rust release target triple.
     required: true
@@ -14,6 +18,7 @@ runs:
     - name: Set up Bazel
       uses: ./.github/actions/prepare-bazel-ci
       with:
+        remote-credentials: ${{ inputs.remote-credentials }}
         target: ${{ inputs.target }}
         cache-scope: bazel-release
 

.github/actions/build-codex-packages/action.yml

@@ -1,6 +1,10 @@
 name: build-codex-packages
 description: Build and smoke-test unsigned Codex CLI and app-server release packages.
 inputs:
+  remote-credentials:
+    description: Boolean credential availability; callers must explicitly report whether their Bazel credential is configured.
+    required: false
+    default: "false"
   target:
     description: Rust release target triple to build and test.
     required: true
@@ -77,6 +81,7 @@ runs:
       if: inputs.build-system == 'bazel'
       uses: ./.github/actions/build-bazel-package-binaries
       with:
+        remote-credentials: ${{ inputs.remote-credentials }}
         target: ${{ inputs.target }}
         build-mode: ${{ inputs.build-mode }}
 

.github/actions/prepare-bazel-ci/action.yml

@@ -11,6 +11,14 @@ inputs:
     description: Provision pinned tools for the authorized native Windows fallback.
     required: false
     default: "false"
+  windows-resource-observation:
+    description: Observe bounded hosted Windows diagnostic resources.
+    required: false
+    default: "false"
+  remote-credentials:
+    description: Boolean credential-availability receipt from the caller; external callers must report it explicitly rather than infer keylessness from the default.
+    required: false
+    default: "false"
 outputs:
   repository-cache-path:
     description: Filesystem path used for the Bazel repository cache.
@@ -36,6 +44,7 @@ runs:
       with:
         target: ${{ inputs.target }}
         native-windows-voice: ${{ inputs.native-windows-voice }}
+        windows-resource-observation: ${{ inputs.windows-resource-observation }}
 
     - name: Compute bazel repository cache key
       id: cache_bazel_repository_key
@@ -52,6 +61,14 @@ runs:
     # do not need to be re-downloaded on every CI run. Keep restore failures
     # non-fatal so transient cache-service errors degrade to a cold build
     # instead of failing the job.
+    - name: Observe storage before repository restore
+      if: runner.environment == 'github-hosted' && (runner.os == 'Linux' || runner.os == 'macOS') && github.repository == 'CompleteDotTech/codex-subagents-multi-provider'
+      continue-on-error: true
+      env:
+        HOSTED_STORAGE_REMOTE_CREDENTIALS: ${{ inputs.remote-credentials }}
+      shell: bash
+      run: python3 .github/scripts/hosted_storage.py observe before-restore none
+
     - name: Restore bazel repository cache
       id: cache_bazel_repository_restore
       continue-on-error: true
@@ -62,6 +79,14 @@ runs:
         restore-keys: |
           ${{ steps.cache_bazel_repository_key.outputs.repository-cache-restore-key }}
 
+    - name: Observe storage after repository restore
+      if: always() && !cancelled() && runner.environment == 'github-hosted' && (runner.os == 'Linux' || runner.os == 'macOS') && github.repository == 'CompleteDotTech/codex-subagents-multi-provider'
+      continue-on-error: true
+      env:
+        HOSTED_STORAGE_REMOTE_CREDENTIALS: ${{ inputs.remote-credentials }}
+      shell: bash
+      run: python3 .github/scripts/hosted_storage.py observe after-restore none
+
     - name: Set up Bazel execution logs
       shell: bash
       run: |

.github/actions/run-argument-comment-lint/action.yml

@@ -16,6 +16,7 @@ runs:
     - uses: ./.github/actions/prepare-bazel-ci
       with:
         target: ${{ inputs.target }}
+        remote-credentials: ${{ inputs.buildbuddy-api-key != '' }}
         cache-scope: bazel-argument-comment-lint
 
     - name: Install Linux sandbox build dependencies

.github/actions/setup-bazel-ci/action.yml

@@ -8,6 +8,10 @@ inputs:
     description: Provision pinned job-local tools for this fork's native Windows fallback.
     required: false
     default: "false"
+  windows-resource-observation:
+    description: Observe bounded hosted Windows diagnostic resources.
+    required: false
+    default: "false"
 outputs:
   repository-cache-path:
     description: Filesystem path used for the Bazel repository cache.
@@ -19,6 +23,12 @@ runs:
     - id: setup_ci
       uses: ./.github/actions/setup-ci
 
+    - name: Observe resources after build path provisioning
+      if: inputs.windows-resource-observation == 'true' && runner.os == 'Windows' && runner.environment == 'github-hosted' && github.repository == 'CompleteDotTech/codex-subagents-multi-provider'
+      continue-on-error: true
+      shell: pwsh
+      run: python .github/scripts/observe_windows_ci_resources.py after-provision
+
     - name: Set up Bazel
       uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # 0.19.0
       # Without an explicit Bazelisk version, setup-bazel leaves PATH unchanged