ci: fold the imported workflows into this repo's set

[bgm-malbeclabs]

Step 5 of the monorepo migration, per docs/superpowers/specs/2026-08-27-monorepo-migration-design.md. Stacked on #4255 and based on that branch, so the diff shown here is step 5 alone.

The 11 workflows that came with the two source repos are folded into this repo's set, and the imported .github directories are deleted. GitHub reads workflows only at the repository root, so nothing in those directories has ever run here.

Where each imported workflow went

Imported	Fate
offchain release.contributor-rewards.yml	ported, release.contributor-rewards.yml
offchain release.doublezero-solana-cli.yml	ported, release.doublezero-solana-cli.yml
offchain release.sentinel.yml	ported, release.offchain-sentinel.yml
offchain release.solana-validator-debt.yml	ported, release.solana-validator-debt.yml
offchain release.scheduler.yml	ported, release.offchain-scheduler.yml
offchain local-validator.yml	ported, offchain.local-validator.yml, two live jobs of four
offchain ci.yml	dropped; make rust-build/rust-lint/rust-test cover those crates now
offchain changelog-reminder.yml	merged into this repo's changelog-reminder.yml
solana rust.yml + verify-build.yml	ported as one new solana.yml
solana local-validator.yml	dropped; every job in it was if: false upstream
—	new elixir.yml, which had no upstream equivalent in CI

Summary

• The five release workflows run goreleaser from the repository root, not from offchain/. The merged workspace writes to the root target/, which is where goreleaser's rust builder looks for the binary it packages; running it from offchain/ would send it looking in offchain/target/. Every relative path inside the five configs is rewritten to match, including the scheduler's four mix hooks and its _build source.
• release.github.name moves from doublezero-offchain to doublezero in all five configs, so the releases land on this repository. The owner was already corrected during the org move. This repo already holds CLOUDSMITH_TOKEN, GORELEASER_KEY and SLACK_BOTS_WEBHOOK, so the spec's "copy three secrets" step is already done.
• New solana workflow, and it matters more than a port. The solana/ tree is an excluded nested workspace, so rust.yml never reaches it: without this, the two Solana L1 programs would sit in this repo with no CI at all. It runs that tree's own lint, library tests, docs and SBF tests for both networks, plus the checksum gate that rebuilds the artifacts and verifies them against solana/programs/sha256sums_*.txt. Path-scoped to solana/**.
• New elixir workflow, path-scoped to offchain/scheduler/**: format check, compile with warnings as errors, credo, tests. Upstream these ran on a release tag only, so a pull request that broke the scheduler passed and the tag failed later.
• offchain-local-validator runs from the repository root, because the fork scripts resolve their binaries as target/debug/<name> and create their keypairs and test-ledger/ in the working directory, so all of it has to agree on one. Path-scoped to offchain/**, solana/** and the root manifests rather than running on every pull request as it did in a quieter repo.
• rust-cli-static covers all five released CLIs instead of the client alone, which is what offchain's rust-musl-static job did for its four. Each package is built on its own so feature unification matches the release. The job keeps its name, since it is a required status check.
• changelog-reminder keeps offchain's per-crate check, paths moved under offchain/. This is a union, not a dedupe: a change to one of those 13 subprojects now needs both the root CHANGELOG.md and that subproject's own.

What is deliberately not carried over

• The just ci coverage floor (cargo llvm-cov nextest --fail-under-lines 25). It measured a workspace that no longer exists, and running it over the merged workspace would both mean something different and cost a full instrumented build of 37 crates on every run.
• The two dead fork jobs: one if: false, one commented out with a note about bringing it back. Both are in the imported history if wanted.
• offchain/Justfile's Rust recipes. From offchain/ they would now run cargo over the whole workspace, and with a different fmt line (group_imports=StdExternalCrate) and clippy line than CI uses. The Elixir recipes stay, plus two fork-test recipes that cd to the root.

Testing Verification

• actionlint over every new and changed workflow: no errors. The only output is SC2086 info notes on $SOLANA_CLI and $GITHUB_PATH, the same pattern the existing rust.yml jobs already carry.
• The shell body of the rewritten changelog-reminder check parses under bash -n, and offchain/scripts/release-rc.sh still parses after the path changes.
• just -l in offchain/ lists the trimmed recipe set.
• cd solana && make lint passes, which is the job solana.yml runs first. Worth stating because step 4 reformatted three files in that tree with the root's imports_granularity=Crate: plain rustfmt preserves existing import grouping, so solana's own cargo fmt --check still agrees.
• NETWORK is passed as mainnet-beta or development explicitly, never empty: solana/Makefile validates it and errors on anything else.
• The three CI workflows here trigger on this pull request, so they prove themselves. The five release workflows only fire on a tag, so they stay unproven until the spec's own gate: a throwaway release candidate tag on the smallest component, confirming the release lands under malbeclabs and the package reaches Cloudsmith.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2c34df3. Configure here.}

[cursor]

Stale scheduler release binary path

High Severity

Issue
The scheduler release looks for the prebuilt binary under ./scheduler/_build, but the mix hooks now write that tree under offchain/scheduler/_build. GoReleaser fails when it cannot find the artifact.

Context
An operator pushes an offchain-scheduler/v*.*.* tag, or runs release-rc.sh for this config, from the repository root. The four mix hooks and the package src already name offchain/scheduler.

Proposed Fix
Point the prebuilt path at ./offchain/scheduler/_build/prod/rel/scheduler/bin/scheduler.

 

^{Reviewed by Cursor Bugbot for commit 2c34df3. Configure here.}