fix(ci): split source checks by toolchain

.gitea/workflows/cicd-source-checks.yaml

@@ -128,8 +128,8 @@ jobs:
           echo "=== Kernel Tail ==="
           dmesg | tail -n 120 || true
 
-  source-precommit-checks:
-    name: Source Pre-commit Checks (backend+frontend)
+  source-precommit-checks-backend:
+    name: Source Pre-commit Checks (backend)
     runs-on: ubuntu-act
     timeout-minutes: 40
     needs: setup
@@ -194,7 +194,106 @@ jobs:
             exit 1
           }
 
-      - name: Bootstrap source-check toolchain
+      - name: Bootstrap backend toolchain
+        run: |
+          set -euo pipefail
+
+          if ! command -v curl >/dev/null 2>&1; then
+            apt-get update -qq
+            apt-get install -y -qq curl ca-certificates
+          fi
+
+          if ! command -v uv >/dev/null 2>&1; then
+            curl -LsSf https://astral.sh/uv/install.sh | sh
+          fi
+          export PATH="$HOME/.local/bin:$PATH"
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      - name: Install backend dependencies
+        run: |
+          set -euo pipefail
+          export PATH="$HOME/.local/bin:$PATH"
+          export UV_LINK_MODE=copy
+
+          cd backend
+          uv sync --dev
+
+      - name: Run backend pre-commit source checks
+        env:
+          CI: "true"
+        run: |
+          set -euo pipefail
+          export PATH="$HOME/.local/bin:$PATH"
+          cd backend
+          uv run pre-commit run --all-files --show-diff-on-failure --config ../.pre-commit-config.yaml \
+            trailing-whitespace end-of-file-fixer check-merge-conflict check-added-large-files \
+            check-yaml check-json check-toml mixed-line-ending markdownlint pretty-format-toml \
+            ruff ruff-format pyright pydoclint no-docstring-types
+
+      - *failure_diagnostics_step
+
+  source-precommit-checks-frontend:
+    name: Source Pre-commit Checks (frontend)
+    runs-on: ubuntu-act
+    timeout-minutes: 40
+    needs: setup
+    steps:
+      - name: Identify runner
+        run: |
+          echo "=== Runner Identity ==="
+          echo "runner_name=${RUNNER_NAME:-}"
+          echo "runner_name_hint=${GITEA_RUNNER_NAME:-${ACT_RUNNER_NAME:-${RUNNER_NAME:-unknown}}}"
+          echo "runner_hostname_env=${HOSTNAME:-unknown}"
+          echo "runner_uname_n=$(uname -n 2>/dev/null || echo unknown)"
+          echo "runner_etc_hostname=$(cat /etc/hostname 2>/dev/null || echo unknown)"
+          echo "runner_os=${RUNNER_OS:-unknown}"
+          echo "runner_arch=${RUNNER_ARCH:-unknown}"
+          echo "timestamp_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+
+      - name: Configure registry host resolution
+        run: |
+          if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then
+            echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts
+          fi
+
+      - name: Checkout source snapshot
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+          HEAD_SHA: ${{ needs.setup.outputs.head_sha }}
+        run: |
+          set -e
+          umask 022
+          trap 'rm -f ~/.ssh/id_rsa' EXIT
+
+          mkdir -p ~/.ssh
+          echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa
+          chmod 600 ~/.ssh/id_rsa
+          ssh-keyscan -p "${GITEA_SSH_PORT}" "${GITEA_SSH_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
+
+          GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
+            git clone --depth 1 --no-checkout "${GITEA_REPO_SSH_URL}" .
+
+          if GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
+            git fetch --depth 1 origin "${HEAD_SHA}" >/dev/null 2>&1; then
+            git checkout FETCH_HEAD -- .
+            echo "Using fetched HEAD_SHA checkout: ${HEAD_SHA}"
+          else
+            git checkout HEAD -- .
+            echo "Falling back to default branch HEAD for source checks checkout"
+          fi
+
+          test -f .pre-commit-config.yaml || {
+            echo "❌ Missing .pre-commit-config.yaml after checkout"
+            exit 1
+          }
+
+          test -f frontend/package.json || {
+            echo "❌ Missing frontend/package.json after checkout"
+            find . -maxdepth 3 -type f | sort | head -n 80
+            exit 1
+          }
+
+      - name: Bootstrap frontend toolchain
         run: |
           set -euo pipefail
 
@@ -203,14 +302,12 @@ jobs:
             apt-get install -y -qq curl ca-certificates
           fi
 
-          # Install uv if missing and expose it for subsequent steps.
           if ! command -v uv >/dev/null 2>&1; then
             curl -LsSf https://astral.sh/uv/install.sh | sh
           fi
           export PATH="$HOME/.local/bin:$PATH"
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
-          # Ensure node/corepack is available for frontend and pre-commit hooks.
           if ! command -v node >/dev/null 2>&1; then
             apt-get update -qq
             apt-get install -y -qq nodejs npm
@@ -221,28 +318,27 @@ jobs:
 
           corepack enable
 
-      - name: Install backend and frontend dependencies
+      - name: Install frontend dependencies
         run: |
           set -euo pipefail
-          export PATH="$HOME/.local/bin:$PATH"
-          export UV_LINK_MODE=copy
           export NODE_OPTIONS="--max-old-space-size=512"
           export YARN_NETWORK_CONCURRENCY=1
+          export PATH="$HOME/.local/bin:$PATH"
 
           cd backend
-          uv sync --dev
-          cd ../frontend
-          # Keep Yarn in low-memory mode on constrained ARM runners.
+          uv tool install pre-commit
+          cd frontend
           yarn install --immutable --mode=skip-build
 
-      - name: Run pre-commit source checks
+      - name: Run frontend pre-commit source checks
         env:
           CI: "true"
         run: |
           set -euo pipefail
-          export PATH="$HOME/.local/bin:$PATH"
+          export PATH="$HOME/.local/share/mise/shims:$HOME/.local/bin:$HOME/.local/share/uv/tools/pre-commit/bin:$PATH"
           cd backend
-          uv run pre-commit run --all-files --show-diff-on-failure --config ../.pre-commit-config.yaml
+          pre-commit run --all-files --show-diff-on-failure --config ../.pre-commit-config.yaml \
+            eslint prettier typescript-check tsdoc-lint
 
       - *failure_diagnostics_step
 
@@ -250,7 +346,7 @@ jobs:
     name: Dispatch Downstream Build
     runs-on: ubuntu-act
     timeout-minutes: 10
-    needs: [setup, source-precommit-checks]
+    needs: [setup, source-precommit-checks-backend, source-precommit-checks-frontend]
     steps:
       - name: Identify runner
         run: |