ci: convert 5 zero-risk gating-lane steps to if:always() (item 7 scoping pass)

[mixmansoundude]

Summary

• Owner-requested dedicated scoping pass for CLAUDE.md Active Backlog item 7 (gating-lane if: always() hardening, previously deferred pending exactly this kind of reviewed pass).
• Catalogued all 123 steps in the selftest job: ~44 already carry always()/failure(); the real risk band is ~67 steps downstream of "Bootstrap environment" with no always(), so one early failure silently skips everything after it.
• Traced every one of those ~67 steps to its underlying script and found exactly 5 that never execute run_setup.bat as a subprocess at all — a static byte-size tripwire, a static embedded-payload decode check, and three pure python -m unittest/pytest invocations against this repo's own helper unit tests. Converting these to if: always() carries zero duration-inflation risk since there's nothing to redundantly retry.
• The remaining ~62 steps genuinely spin up their own scratch-dir run_setup.bat bootstrap, so the original blast-radius concern still holds there — but this pass sharpens why: Miniconda installs to a shared, machine-wide path, so once it succeeds once, downstream steps reuse it for free. The duration-inflation risk is specifically scoped to "Miniconda itself fails to install," not "any bootstrap failure" — confirmed via this session's own owner-authorized CI fault-injection experiment (two synthetic regressions on throwaway branches, both of which failed fast rather than via a slow network timeout).
• A concrete follow-on design (a shared "is conda already available" fast pre-check) is documented in CLAUDE.md for the remaining ~62-step band, deliberately not implemented in this pass.

Test plan

• python -m compileall -q .
• python tools/check_delimiters.py run_setup.bat
• python -m yamllint .github/workflows/
• actionlint -oneline .github/workflows/*.yml
• ASCII sweep over touched files
• PowerShell AST parse sweep over tests/*.ps1, tools/*.ps1
• python -m pytest tests/test_*.py -q (437 passed, 2 skipped)
• Real Windows CI (this PR) — confirm the 5 converted steps still pass normally on a clean run, and that yamllint/actionlint results hold in CI too

Claude-Session: https://claude.ai/code/session_015xbWLPbiaKVsobB9FZy8kS

---

Generated by Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.