🔭 ci: Codegraph Test-Selection Probe (Observe-Only) (#14936)

* ci: codegraph test-selection probe (observe-only)

Asks the codegraph service which test files and matrix jobs the PR
needs and writes the decision to the job summary. Gates nothing —
every path exits 0, forks without secrets no-op. Companion to the
shadow-mode evaluation: the decision CI would act on, made visible
next to the runs it would have replaced.

* chore: remove GitNexus CI and deployment configs

Superseded by the codegraph service: the index workflow spent ~45min
per invocation building an artifact the PR flow never served, while
the replacement indexes incrementally in ~1.4s per commit server-side.
Removes the four workflows (index, deploy, cleanup-pr, pr-command) and
the .do/gitnexus deployment bundle. No remaining references.

* ci: render playwright spec tiers in the codegraph probe summary

.github/workflows/codegraph-select.yml

@@ -0,0 +1,72 @@
+# Codegraph test selection — OBSERVE-ONLY.
+#
+# Asks the codegraph service which test files / matrix jobs this PR actually needs and writes
+# the answer to the job summary. It gates NOTHING: no workflow reads its outputs yet, it cannot
+# fail the PR (every path exits 0), and forks without secrets no-op silently. This is the
+# production probe for the shadow-mode evaluation: the same decision CI would act on, made
+# visible next to the runs it would have replaced.
+#
+# Requires repo secrets: CODEGRAPH_URL (https endpoint), CODEGRAPH_TOKEN (bearer).
+name: Codegraph Select (observe)
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  select:
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    steps:
+      - name: Ask codegraph, render, never fail
+        env:
+          URL: ${{ secrets.CODEGRAPH_URL }}
+          TOKEN: ${{ secrets.CODEGRAPH_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set +e
+          note() { echo "$1" >> "$GITHUB_STEP_SUMMARY"; }
+          note "### Codegraph select — observe-only"
+          if [ -z "$URL" ] || [ -z "$TOKEN" ]; then note "_secrets not configured; skipped_"; exit 0; fi
+
+          gh api "repos/$REPO/pulls/$PR/files" --paginate \
+            --jq '.[] | {path: .filename, status, patch}' | jq -s . > files.json
+          if [ ! -s files.json ]; then note "_could not fetch changed files; skipped_"; exit 0; fi
+
+          jq -c --arg b "$BASE_SHA" --arg h "$HEAD_SHA" \
+            '{files: ., lockBaseSha: $b, lockHeadSha: $h}' files.json > body.json
+          RESP=$(curl -sS -m 45 -H "Authorization: Bearer $TOKEN" \
+            -H 'content-type: application/json' --data-binary @body.json "$URL/v1/select")
+          if [ -z "$RESP" ] || ! echo "$RESP" | jq -e .selected >/dev/null 2>&1; then
+            note "_codegraph unavailable (${RESP:0:120}); skipped — full CI runs as always_"
+            exit 0
+          fi
+
+          echo "$RESP" | jq -r '
+            "graph `\(.gate.head[0:12] // "?")` · \(.engine) · \(.mode) · \(.ms)ms · reached \(.reached)",
+            "",
+            "| workspace | decision |",
+            "|---|---|",
+            (.selected | to_entries[] |
+              "| \(.key) | " + (if .value.mode == "FULL" then "FULL — \(.value.why)"
+                elif .value.mode == "NONE" then "no tests"
+                else "\(.value.files | length) test files" end) + " |"),
+            "",
+            "matrix: " + ([.matrix | to_entries[] | .key as $wf | .value | to_entries[] |
+              "\($wf)/\(.key)=" + (if .value then "run" else "SKIP" end)] | join("  ")),
+            (if .shards then "shards: " + (.shards | to_json) else empty end),
+            (if .lock_workspaces then "lockfile → " + (.lock_workspaces | to_json) else empty end),
+            (if .e2e and (.e2e.error | not) then
+              "e2e tiers: must \(.e2e.must_run | length) · floor \(.e2e.floor | length) · skippable \(.e2e.skippable | length)" +
+              (if (.e2e.must_run | length) > 0 then " — must: " + (.e2e.must_run[:4] | join(", ")) else "" end)
+            else empty end)
+          ' >> "$GITHUB_STEP_SUMMARY"
+          exit 0