Advance M7 workflows and release operations

docs/web/CI.md

@@ -0,0 +1,47 @@
+# M6 CI contract
+
+The repository remote is Gitea, so the authoritative workflow is
+`.gitea/workflows/m6-ci.yml`. `main` is the protected release ref. Pull requests and ordinary
+pushes run quick and Chromium lanes; the release lane runs only for a `main` push or an explicit
+`workflow_dispatch`.
+
+## Pinned runner matrix
+
+| Component | Pinned value | Lane |
+| --- | --- | --- |
+| Runner | self-hosted Debian 13 x86_64, labels `blender-web` / `blender-web-release` | all |
+| Node.js | 20.19.2 | all |
+| npm | lockfile-compatible npm 9 | all |
+| Playwright | 1.62.1 | Chromium, release |
+| Chromium | Playwright Chromium 149.0.7827.55 or `CHROME_PATH` override | Chromium, release |
+| Blender | official Blender 5.2.0 LTS with USD enabled, configured by `BLENDER_BIN` | release |
+| Emscripten | 3.1.69 | release |
+
+`BLENDER_ARCHIVE_SHA256` must identify the official Blender archive used by acceptance. VDB jobs
+use `VDB_RESOURCE_ROOT`; when it is absent, tools resolve `resource-library/blender-web-vdb`
+under the runner home directory.
+
+## Lane contents
+
+`npm --prefix web run ci:quick` installs from `package-lock.json`, then runs typecheck, lint, Node
+tests, status consistency and release-evidence schema checks.
+
+`npm --prefix web run ci:chromium` runs the P0 user loop (including main-thread and Offscreen
+viewports), release browser smoke, network interruption, device loss, OOM, real OPFS quota,
+malicious blend and archive gates. Every browser command receives a newly allocated loopback port;
+Playwright owns and cleans its server process.
+
+`npm --prefix web run ci:release` runs full E2E, the complete performance and VDB matrices, V1
+acceptance, reproducible offline packaging, archive cold boot, and binary/source independent
+verification.
+
+Each lane writes `release/ci-reports/<lane>.json`, a sidecar SHA-256 and one immutable log per
+command. Reports use `docs/status/ci-lane-report.schema.json` and bind the commit, lockfile, parity
+ledger, engine manifest, SBOM, available archives and every command log. A failed subcommand writes
+an atomic `FAILED` report before the lane exits nonzero; it cannot reuse an older READY report.
+
+The npm cache key is derived from `web/package-lock.json`. The Emscripten cache additionally binds
+version 3.1.69 and `tools/web/emscripten-env.sh`. Release evidence, reports and archives are never
+cache inputs. Artifact retention is fixed at 7 days for quick, 14 days for Chromium and 30 days for
+release; the report checker runs before upload.
+