ci: make the Desktop update E2E required and drop a dead wine2e nodeid

e2e-desktop-update ran with continue-on-error, so a PR touching the
Desktop update path could merge on a red "Update now" hand-off. It has
passed every main-push shard on record (48/48 over the last 12 main CI
runs), so it now gates the merge whenever the e2e_desktop_update lane
fires, like the Linux e2e-upgrade shards and the Windows install +
update journey already do for e2e_upgrade (skipped = success otherwise).

windows-venv-e2e.yml listed
tests/hermes_cli/test_runtime_repair.py::TestWindowsRuntimeSelfLock, a
file that never existed on main; run_tests.sh dropped it silently. The
in-use-runtime replacement it meant to prove now lives in pm and is
tests/pm/test_held_entry_windows_live.py.

Tests pin both: every real-update suite reaches all-checks-pass, is
gated on its lane and is never continue-on-error; every path the
wine2e lane runs is an existing test file.

(cherry picked from commit f4791428341afaf67cc53775653dde197591fa4f)
(cherry picked from commit 5d3a4b505fe5c3858a6bb7f3554c97eb272231ca)

.github/workflows/ci.yaml

@@ -209,8 +209,11 @@ jobs:
     needs: detect
     # apps/desktop/e2e/update: a real install.sh install + packaged Desktop,
     # first run, "Update now" hand-off/relaunch, concurrent-update refusal.
-    # Advisory until it has proven stable on CI: its shards run with continue-on-error, so a
-    # red shard shows on the PR but does not fail all-checks-pass.
+    # Required when it runs: a PR that touches the Desktop update path (the
+    # classifier's e2e_desktop_update lane) cannot merge on a red shard. Like
+    # the Linux e2e-upgrade shards and the Windows install + update journey
+    # (tests / tests-os, gated on e2e_upgrade), it is skipped — and the skip
+    # counts as success — when the PR does not touch that path.
     if: needs.detect.outputs.e2e_desktop_update == 'true'
     uses: ./.github/workflows/e2e-desktop-update.yml
 

.github/workflows/e2e-desktop-update.yml

@@ -28,8 +28,8 @@ jobs:
     name: Desktop install/update E2E (Linux, ${{ matrix.cell }})
     runs-on: ubuntu-latest-32-core
     timeout-minutes: 30
-    # Advisory until stable on CI (see ci.yaml): a red shard does not fail the caller.
-    continue-on-error: true
+    # Required whenever the e2e_desktop_update lane fires (see ci.yaml): it was
+    # advisory until it proved stable, and every main push shard since has passed.
     strategy:
       fail-fast: false
       # One install per shard (every spec restores it; paths are baked in, so

.github/workflows/windows-venv-e2e.yml

@@ -67,7 +67,7 @@ jobs:
             tests/hermes_cli/test_venv_holder_windows_live.py \
             tests/hermes_cli/test_taskkill_identity_windows_live.py \
             tests/hermes_cli/test_git_trampoline_windows_live.py \
-            tests/hermes_cli/test_runtime_repair.py::TestWindowsRuntimeSelfLock
+            tests/pm/test_held_entry_windows_live.py
 
       - name: Run Telegram CLOSE-WAIT reconnect live E2E (#87057)
         shell: bash

tests/ci/test_classify_changes.py

@@ -542,6 +542,44 @@ def _iter_if_expressions(job: object):
             yield cond
 
 
+# (caller workflow, job, called workflow, lane input) for every real-update
+# suite: each runs on a PR exactly when its lane fires and then gates the merge.
+_REAL_UPDATE_LANES = (
+    ("ci.yaml", "tests", "tests.yml", "e2e_upgrade"),
+    ("ci.yaml", "tests-os", "tests-os.yml", "e2e_upgrade"),
+    ("ci.yaml", "e2e-desktop-update", "e2e-desktop-update.yml", "e2e_desktop_update"),
+    ("tests-os.yml", "install-update-e2e", "windows-install-update-e2e.yml", "e2e_upgrade"),
+)
+
+
+@pytest.mark.parametrize("caller,job,called,lane", _REAL_UPDATE_LANES)
+def test_real_update_suites_gate_the_merge_when_their_lane_fires(caller, job, called, lane):
+    """A real-update suite that runs but cannot fail the merge is decoration.
+
+    Each one must reach ``all-checks-pass`` (directly, or through the
+    reusable workflow that calls it), be gated on its lane, and never be
+    ``continue-on-error``: a red shard has to block the PR it ran for.
+    """
+    ci = _yaml(".github/workflows/ci.yaml")
+    caller_jobs = _yaml(f".github/workflows/{caller}")["jobs"]
+    assert caller_jobs[job]["uses"] == f"./.github/workflows/{called}"
+    gate = caller_jobs[job].get("if", "") + json.dumps(caller_jobs[job].get("with") or {})
+    assert lane in gate, f"{caller}::{job} is not gated on {lane}"
+    root = job if caller == "ci.yaml" else "tests-os"
+    assert root in ci["jobs"]["all-checks-pass"]["needs"]
+    for name, body in _yaml(f".github/workflows/{called}")["jobs"].items():
+        assert not body.get("continue-on-error"), f"{called}::{name} cannot fail the merge"
+
+
+def test_windows_venv_e2e_runs_only_test_files_that_exist():
+    """``run_tests.sh`` drops a missing path (or a ``::node`` selector) without
+    a word, so a stale entry silently stops running on every wine2e push."""
+    text = (_REPO / ".github/workflows/windows-venv-e2e.yml").read_text(encoding="utf-8")
+    paths = re.findall(r"(tests/[\w/.:-]+)", text)
+    assert paths
+    assert [p for p in paths if "::" in p or not (_REPO / p).is_file()] == []
+
+
 def _write_event(tmp_path, number: int | None = 88442) -> Path:
     payload = {"pull_request": {"number": number}} if number is not None else {}
     path = tmp_path / "event.json"