fix(ci): provision native build headroom

.woodpecker.yml

@@ -117,11 +117,14 @@ steps:
             ephemeral-storage: 1Gi
 
   legacy-authority-build:
-    depends_on: [legacy-authority-source]
-    image: mirror.gcr.io/oven/bun:1.3.14@sha256:e10577f0db68676a7024391c6e5cb4b879ebd17188ab750cf10024a6d700e5c4
+    depends_on: [legacy-authority-source, bun-runtime]
+    image: docker.io/library/rust:1.86-slim-bookworm@sha256:57d415bbd61ce11e2d5f73de068103c7bd9f3188dc132c97cef4a8f62989e944
+    environment:
+      RUSTFLAGS: "-C link-arg=-fuse-ld=lld"
     commands:
-      - cd .continuity/omp && bun install --frozen-lockfile
-      - cd .continuity/omp && bun run build:native
+      - sh scripts/cluster-ci/install-legacy-authority-toolchain.sh
+      - (cd .continuity/omp && bun install --frozen-lockfile)
+      - (cd .continuity/omp && bun run build:native)
     backend_options:
       kubernetes:
         serviceAccountName: woodpecker-ci-untrusted
@@ -132,8 +135,8 @@ steps:
             ephemeral-storage: 1Gi
           limits:
             cpu: "2"
-            memory: 4Gi
-            ephemeral-storage: 6Gi
+            memory: 6Gi
+            ephemeral-storage: 12Gi
 
   legacy-bridge-continuity:
     depends_on: [legacy-authority-build]
@@ -257,8 +260,8 @@ steps:
             ephemeral-storage: 256Mi
           limits:
             cpu: "1"
-            memory: 2Gi
-            ephemeral-storage: 2Gi
+            memory: 4Gi
+            ephemeral-storage: 6Gi
 
   cluster-chart-tests:
     depends_on: [cluster-operator-tests]

scripts/cluster-ci/cluster-ci-contract.test.mjs

@@ -242,6 +242,10 @@ function liveClusterResponses() {
 
 test("Woodpecker keeps upstream gates and serializes bounded cluster publication", async () => {
   const pipeline = yaml.load(await readFile(resolve(repoRoot, ".woodpecker.yml"), "utf8"));
+  const legacyInstaller = await readFile(
+    resolve(repoRoot, "scripts/cluster-ci/install-legacy-authority-toolchain.sh"),
+    "utf8",
+  );
   assert.equal(typeof pipeline, "object");
   const steps = pipeline.steps;
   const coreCommands = steps["upstream-core"].commands;
@@ -263,6 +267,35 @@ test("Woodpecker keeps upstream gates and serializes bounded cluster publication
       `pipeline 38:64 reproduced unfiltered core workspace traversal as "Failed to find executable flutter": ${command}`,
     );
   }
+  assert.deepEqual(steps["legacy-authority-build"].depends_on, [
+    "legacy-authority-source",
+    "bun-runtime",
+  ]);
+  assert.equal(
+    steps["legacy-authority-build"].image,
+    "docker.io/library/rust:1.86-slim-bookworm@sha256:57d415bbd61ce11e2d5f73de068103c7bd9f3188dc132c97cef4a8f62989e944",
+  );
+  assert.equal(
+    steps["legacy-authority-build"].environment.RUSTFLAGS,
+    "-C link-arg=-fuse-ld=lld",
+  );
+  assert.match(legacyInstaller, /apt-get install[^\n]*\blld\b/u);
+  assert.match(legacyInstaller, /command -v ld\.lld >\/dev\/null/u);
+  assert.equal(
+    steps["legacy-authority-build"].backend_options.kubernetes.resources.limits.memory,
+    "6Gi",
+  );
+  assert.equal(
+    steps["legacy-authority-build"].backend_options.kubernetes.resources.limits[
+      "ephemeral-storage"
+    ],
+    "12Gi",
+  );
+  assert.deepEqual(steps["legacy-authority-build"].commands, [
+    "sh scripts/cluster-ci/install-legacy-authority-toolchain.sh",
+    "(cd .continuity/omp && bun install --frozen-lockfile)",
+    "(cd .continuity/omp && bun run build:native)",
+  ]);
   assert.ok(steps["legacy-bridge-continuity"].commands.includes("pnpm test:legacy-bridge-continuity"));
   assert.equal(steps["legacy-bridge-continuity"].environment.T4_OMP_SOURCE_DIR, ".continuity/omp");
   assert.ok(
@@ -276,7 +309,13 @@ test("Woodpecker keeps upstream gates and serializes bounded cluster publication
   ]);
   assert.equal(
     steps["cluster-operator-tests"].backend_options.kubernetes.resources.limits.memory,
-    "2Gi",
+    "4Gi",
+  );
+  assert.equal(
+    steps["cluster-operator-tests"].backend_options.kubernetes.resources.limits[
+      "ephemeral-storage"
+    ],
+    "6Gi",
   );
   assert.ok(
     steps["cluster-chart-tests"].commands.includes("helm lint ../../../deploy/charts/t4-cluster"),

scripts/cluster-ci/install-legacy-authority-toolchain.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+set -eu
+
+if [ "$(id -u)" -ne 0 ]; then
+  echo "legacy authority toolchain setup requires root" >&2
+  exit 64
+fi
+
+test -f .ci/bun
+rm -f /etc/apt/sources.list.d/*
+printf '%s\n' \
+  'deb [check-valid-until=no] https://snapshot.debian.org/archive/debian/20250721T000000Z bookworm main' \
+  'deb [check-valid-until=no] https://snapshot.debian.org/archive/debian-security/20250721T000000Z bookworm-security main' \
+  > /etc/apt/sources.list
+apt-get -o Acquire::Check-Valid-Until=false update
+apt-get install -y --no-install-recommends ca-certificates git lld pkg-config libssl-dev
+rm -rf /var/lib/apt/lists/*
+install -m 0755 .ci/bun /usr/local/bin/bun
+test "$(bun --version)" = "1.3.14"
+command -v cargo >/dev/null
+command -v ld.lld >/dev/null