ci: guard test-unit clauses and the rust-cache workspace root

Fail just test-unit when any combined-filter clause selects no tests, so a
renamed module or target cannot silently drop out of the union. Add a
cargo-metadata check that no dependency manifest sits under the workspace
root, run in Unit Tests before rust-cache can save, and select desktop jobs
for bin/hermit.hcl changes. Refresh comments that described removed flags.

Signed-off-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>

scripts/check-rust-cache-workspace-root.mjs

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+// Fails when Swatinem/rust-cache would mistake dependencies for workspace
+// members. rust-cache keeps target/ outputs only for packages whose
+// manifest_path is outside the workspace root; a dependency whose manifest
+// sits under the root (a registry under the checkout, a vendored source, a
+// path dependency into a nested directory) is treated as workspace code and
+// cleaned away. When that covers every dependency the root-workspace cache
+// saves an empty target/, and the exact-key hit blocks every later save.
+//
+// Usage: cargo metadata --all-features --format-version 1 | node scripts/check-rust-cache-workspace-root.mjs
+import { readFileSync } from "node:fs";
+import { sep } from "node:path";
+import { fileURLToPath } from "node:url";
+
+export function dependenciesUnderWorkspaceRoot(metadata) {
+  const members = new Set(metadata.workspace_members);
+  const root = metadata.workspace_root.endsWith(sep)
+    ? metadata.workspace_root
+    : metadata.workspace_root + sep;
+  return metadata.packages
+    .filter((pkg) => !members.has(pkg.id) && pkg.manifest_path.startsWith(root))
+    .map((pkg) => `${pkg.name} ${pkg.version} (${pkg.manifest_path})`);
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  const metadata = JSON.parse(readFileSync(0, "utf8"));
+  const inside = dependenciesUnderWorkspaceRoot(metadata);
+  if (inside.length > 0) {
+    console.error(
+      `${inside.length} non-member package(s) have a manifest under ${metadata.workspace_root}; ` +
+        "rust-cache would treat them as workspace code and save an empty target/. " +
+        "Keep CARGO_HOME and vendored sources outside the checkout (see bin/hermit.hcl).",
+    );
+    for (const line of inside.slice(0, 10)) console.error(`  ${line}`);
+    process.exit(1);
+  }
+  const outside = metadata.packages.length - metadata.workspace_members.length;
+  console.log(`rust-cache workspace root ok: ${outside} dependency package(s) outside ${metadata.workspace_root}`);
+}

scripts/check-rust-cache-workspace-root.test.mjs

@@ -0,0 +1,63 @@
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { test } from "node:test";
+import { fileURLToPath } from "node:url";
+
+import { dependenciesUnderWorkspaceRoot } from "./check-rust-cache-workspace-root.mjs";
+
+const script = fileURLToPath(
+  new URL("./check-rust-cache-workspace-root.mjs", import.meta.url),
+);
+
+function metadata(registry) {
+  return {
+    workspace_root: "/work/buzz",
+    workspace_members: ["path+file:///work/buzz/crates/buzz-core#0.1.0"],
+    packages: [
+      {
+        id: "path+file:///work/buzz/crates/buzz-core#0.1.0",
+        name: "buzz-core",
+        version: "0.1.0",
+        manifest_path: "/work/buzz/crates/buzz-core/Cargo.toml",
+      },
+      {
+        id: "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.0",
+        name: "serde",
+        version: "1.0.0",
+        manifest_path: `${registry}/registry/src/index.crates.io-1949cf8c6b5b557f/serde-1.0.0/Cargo.toml`,
+      },
+    ],
+  };
+}
+
+function check(meta) {
+  return spawnSync("node", [script], {
+    input: JSON.stringify(meta),
+    encoding: "utf8",
+  });
+}
+
+test("a registry outside the checkout passes", () => {
+  const meta = metadata("/home/runner/.cargo-hermit");
+  assert.deepEqual(dependenciesUnderWorkspaceRoot(meta), []);
+  const result = check(meta);
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stdout, /1 dependency package\(s\) outside/);
+});
+
+test("Hermit's default in-checkout registry fails", () => {
+  const meta = metadata("/work/buzz/.hermit/rust");
+  assert.deepEqual(dependenciesUnderWorkspaceRoot(meta), [
+    "serde 1.0.0 (/work/buzz/.hermit/rust/registry/src/index.crates.io-1949cf8c6b5b557f/serde-1.0.0/Cargo.toml)",
+  ]);
+  const result = check(meta);
+  assert.equal(result.status, 1);
+  assert.match(result.stderr, /1 non-member package\(s\) have a manifest under \/work\/buzz/);
+});
+
+test("a sibling directory sharing the root prefix is outside the root", () => {
+  assert.deepEqual(
+    dependenciesUnderWorkspaceRoot(metadata("/work/buzz-cargo")),
+    [],
+  );
+});

scripts/ci-selection.test.mjs

@@ -233,6 +233,7 @@ const scenarios = [
     ["desktop", "mobile", "rust"],
   ],
   ["Justfile", ["Justfile"], ["desktop", "rust"]],
+  ["Hermit environment", ["bin/hermit.hcl"], ["desktop", "rust"]],
   ["CI apt retry", ["scripts/ci-apt-retry.sh"], ["desktop", "rust"]],
   ["integration services", ["docker-compose.yml"], ["rust"]],
   ["CI integration images", ["docker-compose.ci.yml"], ["rust"]],