ci(concierge): fix Canvas reduced-motion test target + bp directives + local-provision port-squatter flake

- reduced-motion.test.ts: the connection-status pulse dot moved from
  SidePanel.tsx into the extracted WorkspacePanelTabs.tsx; retarget the
  motion-safe:animate-pulse assertion to where the guarded indicator now
  lives (was the only red in CI / Canvas -> gates CI / all-required).
- e2e-staging-saas.yml: add bp directives to the 4 new concierge jobs the
  Tier-2g lint flagged — bp-required: pending #2430 for the three real
  push-time staging e2e jobs (creates-workspace / platform / user-tasks,
  aspiring gates sharing the cp#245 de-flake surface), bp-exempt for the
  PR-time compile-only job. #2187 (the sibling's tracker) is closed/unrelated.
- local-provision-e2e.yml (no-flakes RCA): the :8080 kill-step only matched
  procs *named* platform-server, so a differently-named squatter survived,
  our bind went FATAL, and the /health loop false-positived against the
  squatter. Free :8080 from ANY holder (fuser/lsof) and verify our own PID
  owns the port BEFORE trusting /health, in both the stub and real jobs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/e2e-staging-saas.yml

@@ -527,6 +527,7 @@ jobs:
   # therefore has no honest reason to be masked. Runs on push-to-main /
   # workflow_dispatch / cron only (needs live staging infra — never on PR, where
   # the pr-validate job above already posts the workflow's PR status).
+  # bp-required: pending #2430
   e2e-staging-concierge-user-tasks:
     name: E2E Staging Concierge user_tasks
     runs-on: ubuntu-latest
@@ -649,6 +650,7 @@ jobs:
   # a silently-missing platform-agent image can NEVER false-green this gate. Runs
   # on push-to-main / workflow_dispatch / cron only (needs live staging infra +
   # a model — never on PR, where pr-validate posts the workflow's PR status).
+  # bp-required: pending #2430
   e2e-staging-concierge-creates-workspace:
     name: E2E Staging Concierge Creates Workspace
     runs-on: ubuntu-latest
@@ -776,6 +778,9 @@ jobs:
   #     creds. GATING (no mask) — a broken test file fails at PR time.
   #   • concierge-staging (push-to-main/dispatch/cron): the real live run with
   #     staging creds + t.Cleanup teardown.
+  # bp-exempt: PR-time compile-only check (build the concierge e2e test, then
+  # skip execution — no staging creds on PR). pr-validate posts the workflow's
+  # PR status; this job is not itself a branch-protection gate.
   e2e-staging-concierge-compile-skip:
     name: E2E Staging Concierge (compile+skip)
     runs-on: ubuntu-latest
@@ -802,6 +807,7 @@ jobs:
           echo "$out" | grep -q "SKIP: TestConciergePlatformAgent_Staging" \
             || { echo "::error::expected a LOUD skip of TestConciergePlatformAgent_Staging without creds"; exit 1; }
 
+  # bp-required: pending #2430
   e2e-staging-concierge-platform:
     name: E2E Staging Concierge Platform Agent
     runs-on: ubuntu-latest

.gitea/workflows/local-provision-e2e.yml

@@ -168,7 +168,17 @@ jobs:
               killed=$((killed + 1))
             fi
           done
-          if [ "$killed" -gt 0 ]; then sleep 2; echo "Killed $killed stale process(es); :8080 released."; else echo "No stale platform-server found."; fi
+          if [ "$killed" -gt 0 ]; then echo "Killed $killed stale platform-server process(es)."; else echo "No platform-server-named process found."; fi
+          # Belt-and-braces: also free :8080 from ANY holder regardless of process
+          # name. A differently-named squatter (e.g. a leftover Fastify dev server
+          # from another job) survives the comm-name scan above, makes our bind
+          # FATAL, and can false-positive the /health probe below (no-flakes RCA;
+          # tracked alongside #2430). fuser/lsof are present on the ubuntu runner;
+          # if neither exists the name-scan above is the floor.
+          if command -v fuser >/dev/null 2>&1; then fuser -k 8080/tcp 2>/dev/null || true; fi
+          if command -v lsof  >/dev/null 2>&1; then lsof -ti tcp:8080 2>/dev/null | xargs -r kill -9 2>/dev/null || true; fi
+          sleep 2
+          echo ":8080 freed (comm-scan + port-scan swept any squatter)."
 
       - name: Start platform (background)
         working-directory: workspace-server
@@ -182,14 +192,18 @@ jobs:
         run: |
           DEADLINE=300; PID="$(cat workspace-server/platform.pid 2>/dev/null || true)"; start=$(date +%s)
           while :; do
+            # Verify OUR server owns :8080 BEFORE trusting /health. Our server binds
+            # :8080 or exits FATAL, so "our PID alive" <=> "we own :8080"; checking it
+            # first stops a squatter that answers /health on :8080 (our bind having
+            # failed) from false-positiving the gate (no-flakes RCA).
+            if [ -n "$PID" ] && ! kill -0 "$PID" 2>/dev/null; then
+              echo "::error::platform-server exited early (failed to bind :8080 or crashed)"; cat workspace-server/platform.log || true; exit 1
+            fi
             if curl -sf "$BASE/health" >/dev/null; then
               tables=$(docker exec "$PG_CONTAINER" psql -U dev -d molecule -tAc \
                 "SELECT count(*) FROM information_schema.tables WHERE table_schema='public' AND table_name='workspaces'" 2>/dev/null || echo 0)
               [ "$tables" = "1" ] && { echo "healthy + migrated after $(( $(date +%s) - start ))s"; exit 0; }
             fi
-            if [ -n "$PID" ] && ! kill -0 "$PID" 2>/dev/null; then
-              echo "::error::platform-server exited early"; cat workspace-server/platform.log || true; exit 1
-            fi
             [ "$(( $(date +%s) - start ))" -ge "$DEADLINE" ] && { echo "::error::platform not healthy in ${DEADLINE}s"; cat workspace-server/platform.log || true; exit 1; }
             sleep 1
           done
@@ -310,7 +324,15 @@ jobs:
               killed=$((killed + 1))
             fi
           done
-          if [ "$killed" -gt 0 ]; then sleep 2; echo "Killed $killed stale process(es); :8080 released."; else echo "No stale platform-server found."; fi
+          if [ "$killed" -gt 0 ]; then echo "Killed $killed stale platform-server process(es)."; else echo "No platform-server-named process found."; fi
+          # Belt-and-braces: free :8080 from ANY holder regardless of process name
+          # (a differently-named squatter survives the comm-name scan above, makes
+          # our bind FATAL, and can false-positive the /health probe). Mirrors the
+          # stub job's no-flakes fix (tracked alongside #2430).
+          if command -v fuser >/dev/null 2>&1; then fuser -k 8080/tcp 2>/dev/null || true; fi
+          if command -v lsof  >/dev/null 2>&1; then lsof -ti tcp:8080 2>/dev/null | xargs -r kill -9 2>/dev/null || true; fi
+          sleep 2
+          echo ":8080 freed (comm-scan + port-scan swept any squatter)."
 
       - name: Start platform (background)
         working-directory: workspace-server
@@ -322,14 +344,17 @@ jobs:
         run: |
           DEADLINE=300; PID="$(cat workspace-server/platform.pid 2>/dev/null || true)"; start=$(date +%s)
           while :; do
+            # Verify OUR server owns :8080 before trusting /health (no-flakes RCA):
+            # our server binds :8080 or exits FATAL, so checking our PID first stops
+            # a squatter answering /health on :8080 from false-positiving the gate.
+            if [ -n "$PID" ] && ! kill -0 "$PID" 2>/dev/null; then
+              echo "::error::platform-server exited early (failed to bind :8080 or crashed)"; cat workspace-server/platform.log || true; exit 1
+            fi
             if curl -sf "$BASE/health" >/dev/null; then
               tables=$(docker exec "$PG_CONTAINER" psql -U dev -d molecule -tAc \
                 "SELECT count(*) FROM information_schema.tables WHERE table_schema='public' AND table_name='workspaces'" 2>/dev/null || echo 0)
               [ "$tables" = "1" ] && { echo "healthy after $(( $(date +%s) - start ))s"; exit 0; }
             fi
-            if [ -n "$PID" ] && ! kill -0 "$PID" 2>/dev/null; then
-              echo "::error::platform-server exited early"; cat workspace-server/platform.log || true; exit 1
-            fi
             [ "$(( $(date +%s) - start ))" -ge "$DEADLINE" ] && { echo "::error::platform not healthy in ${DEADLINE}s"; cat workspace-server/platform.log || true; exit 1; }
             sleep 1
           done

canvas/src/__tests__/reduced-motion.test.ts

@@ -52,8 +52,10 @@ describe("prefers-reduced-motion compliance", () => {
     expect(src).toContain("motion-safe:animate-pulse");
   });
 
-  it("SidePanel.tsx uses motion-safe:animate-pulse", () => {
-    const src = readSrc("components/SidePanel.tsx");
+  it("WorkspacePanelTabs.tsx uses motion-safe:animate-pulse", () => {
+    // The connection-status dot moved out of SidePanel.tsx into the extracted
+    // WorkspacePanelTabs.tsx; verify the reduced-motion guard followed it.
+    const src = readSrc("components/WorkspacePanelTabs.tsx");
     expect(src.includes("animate-pulse") && !src.includes("motion-safe:animate-pulse")).toBe(false);
     expect(src).toContain("motion-safe:animate-pulse");
   });