ci(workflows): restructure CI checks with git-lock and reporting

Convert per-check CI commands into a unified git-lock protected flow and
add a consolidated report job that aggregates all matrix run results
into the job summary.

2 files changed, 128 insertions, 16 deletions

diff --git a/.github/workflows/ci-check-only.yml b/.github/workflows/ci-check-only.yml
index 0519310..767e098 100644
--- a/.github/workflows/ci-check-only.yml
+++ b/.github/workflows/ci-check-only.yml
@@ -27,15 +27,72 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions-rust-lang/setup-rust-toolchain@v1
 
-      - run: cargo ci --check-${{ matrix.item }}
+      # Every check runs inside a git-lock / git-unlock pair: the final unlock
+      # doubles as the idempotency check, failing the job when the check left
+      # the working tree dirty (e.g. generated docs are out of date).
+      - name: Lock workspace for CI
+        run: cargo ci git-lock
 
-      - name: Check translated docs structure consistency
-        if: matrix.item == 'markdown-code'
-        run: cargo ci --check-docs-structure
+      - name: Run check
+        id: check
+        shell: bash
+        run: |
+          case "${{ matrix.item }}" in
+            build) cargo ci build-check ;;
+            clippy) cargo ci clippy-check ;;
+            # arg-picker has no dedicated command: its tests are covered by
+            # test-all through its mingling-ci.toml override.
+            test|arg-picker) cargo ci test-all ;;
+            # markdown-code also verifies the translated docs structure.
+            markdown-code) cargo ci markdown-check-all && cargo ci markdown-compare-all ;;
+            examples) cargo ci example-check ;;
+            docs-refresh)
+              cargo ci example-refresh
+              cargo ci docsify-refresh
+              cargo ci features-refresh
+              ;;
+            api-docs) cargo ci docs-check ;;
+          esac
+        continue-on-error: true
 
-      - name: Upload docs test result on failure
-        if: failure() && matrix.item == 'markdown-code'
+      - name: Unlock workspace (idempotency check)
+        if: always()
+        run: cargo ci git-unlock
+
+      - name: Fail when the check failed
+        if: steps.check.outcome == 'failure'
+        run: exit 1
+
+      # Collected reports are uploaded even on failure, so the Report job can
+      # render the failures.
+      - name: Upload collect reports
+        if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: docs-test-result-${{ matrix.os }}.md
-          path: .temp/DOCS-TEST-RESULT.md
+          name: ci-collect-${{ matrix.os }}-${{ matrix.item }}
+          path: .temp/reports/collect/
+          if-no-files-found: ignore
+
+  # Collects every matrix run's reports and renders the consolidated result.md
+  # into the job summary. Runs even when some checks failed, so the failures
+  # are still reported.
+  Report:
+    needs: [Check]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+
+      - name: Download collect reports
+        uses: actions/download-artifact@v4
+        with:
+          path: .temp/reports/collect
+          pattern: ci-collect-*
+          merge-multiple: true
+
+      - name: Generate report
+        run: cargo ci report-collect
+
+      - name: Publish report to step summary
+        run: cat .temp/reports/result.md >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a8e1281..7fe0862 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,18 +29,49 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions-rust-lang/setup-rust-toolchain@v1
 
-      - run: cargo ci --check-${{ matrix.item }}
+      # Every check runs inside a git-lock / git-unlock pair: the final unlock
+      # doubles as the idempotency check, failing the job when the check left
+      # the working tree dirty (e.g. generated docs are out of date).
+      - name: Lock workspace for CI
+        run: cargo ci git-lock
+
+      - name: Run check
+        id: check
+        shell: bash
+        run: |
+          case "${{ matrix.item }}" in
+            build) cargo ci build-check ;;
+            clippy) cargo ci clippy-check ;;
+            # arg-picker has no dedicated command: its tests are covered by
+            # test-all through its mingling-ci.toml override.
+            test|arg-picker) cargo ci test-all ;;
+            # markdown-code also verifies the translated docs structure.
+            markdown-code) cargo ci markdown-check-all && cargo ci markdown-compare-all ;;
+            examples) cargo ci example-check ;;
+            docs-refresh)
+              cargo ci example-refresh
+              cargo ci docsify-refresh
+              cargo ci features-refresh
+              ;;
+            api-docs) cargo ci docs-check ;;
+          esac
+        continue-on-error: true
+
+      - name: Unlock workspace (idempotency check)
+        if: always()
+        run: cargo ci git-unlock
 
-      - name: Check translated docs structure consistency
-        if: matrix.item == 'markdown-code'
-        run: cargo ci --check-docs-structure
+      - name: Fail when the check failed
+        if: steps.check.outcome == 'failure'
+        run: exit 1
 
-      - name: Upload docs test result on failure
-        if: failure() && matrix.item == 'markdown-code'
+      - name: Upload collect reports
+        if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: docs-test-result-${{ matrix.os }}.md
-          path: .temp/DOCS-TEST-RESULT.md
+          name: ci-collect-${{ matrix.os }}-${{ matrix.item }}
+          path: .temp/reports/collect/
+          if-no-files-found: ignore
 
   # Build the distributable packages in parallel with the checks, so that the
   # `unreleased` tag and the Pages deployment always publish fresh artifacts.
@@ -105,6 +136,30 @@ jobs:
           git tag -f unreleased
           git push origin unreleased --force
 
+  # Collects every matrix run's reports and renders the consolidated result.md
+  # into the job summary. Runs even when some checks failed, so the failures
+  # are still reported.
+  Report:
+    needs: [Check]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+
+      - name: Download collect reports
+        uses: actions/download-artifact@v4
+        with:
+          path: .temp/reports/collect
+          pattern: ci-collect-*
+          merge-multiple: true
+
+      - name: Generate report
+        run: cargo ci report-collect
+
+      - name: Publish report to step summary
+        run: cat .temp/reports/result.md >> "$GITHUB_STEP_SUMMARY"
+
   Deploy-Github-Pages:
     needs: [Move-Unreleased-Tag]
     permissions: