refactor(build,ci): 현재 상태 검증을 걷어내고 불변조건만 남기는 검증 표면 축소

외부 리뷰("현재 상태를 유지하기 위한 검증이 너무 많고, 그 검증 자체를
다시 검증하는 구조까지 생겼다")를 설계 문서로 정리하고 코드로 반영한다.
설계·판단 근거는 docs/superpowers/specs/2026-09-16-verification-surface-reduction-design.md.

삭제
- .github/ci-gate-matrix.yml(1,025줄) + verify-gate-matrix.sh(568줄):
  Gradle task graph와 workflow graph에 이미 있는 정보의 3중 복제
- verify-gradle-wrapper.sh(799줄): workflow 바이트 해시 잠금.
  wrapper 검증은 gradle/actions/wrapper-validation(full SHA 핀)에 위임
- DeveloperExperienceContractTest 등의 CI YAML mutation 테스트:
  애플리케이션 test suite가 GitHub Actions YAML 파서를 검증하던 계층 역전
- 문서 drift 파서: verifyReadmeCommands, verifyRunbookReferences,
  verifyDocumentedLeafCount, verifyTestSourceSetRegistry
- 빈 레지스트리를 지키던 커스텀 YAML 파서: verifyTrivyignore,
  verifyQuarantineSunset, flaky-quarantine.yaml
- verifyConfigurationPropertiesProcessor, verifyOneTypePerFile:
  각각 ca.spring-config convention과 Checkstyle OneTopLevelClass가 대체
- 정상 입력으로도 성공할 수 없던 messaging always-fail task
- ModuleRegistry의 JSON 필드 집합 정확 일치, sample-portfolio negative guard

이동
- java/quality/spring 공통 설정을 configure(subprojects) 블록에서
  ca.java-conventions / ca.quality-conventions / ca.java-library /
  ca.spring-library convention plugin으로
- 아키텍처 검증을 ca.architecture로, JPA·messaging qualification을
  gradle/qualification/ 아래로, verifyEnvKeys를 :app-bootstrap 소유로

완화
- Git revision은 releaseCheck·아카이브 생성에서만 요구. 일반 빌드는 SNAPSHOT
- SpotBugs/FindSecBugs는 로컬 check에서 빼고 qualityCheck 레인으로

task 계층
- leaf check는 그 leaf만. architectureCheck / qualityCheck /
  configContractCheck / integrationCheck / ci / releaseCheck로 이름 분리

CI
- _reusable-gradle.yml 신규. checkout + wrapper validation + JDK/캐시 공통화
- fileserver-release.yml -> fileserver-certification.yml (CD가 아니라 certification)
- GitHub Actions = CI + artifact, Argo CD = CD 경계를 docs/ci-cd/boundary.md로 고정

순증감 +3,274 / -7,483.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/ci-quality-gates.yml

@@ -1,5 +1,14 @@
 name: ci-quality-gates
 
+# The pull-request gate. Everything here blocks a merge.
+#
+# The job list used to include `gate-matrix-lint`, which ran .github/scripts/verify-gate-matrix.sh
+# against .github/ci-gate-matrix.yml: a 1,025-line register of all 107 CI controls, checked for
+# consistency against the Gradle task graph and this workflow by a 568-line shell script, which was
+# itself checked by contract tests in :app-bootstrap. Adding one check meant editing Gradle, a
+# workflow, the matrix, the verifier's expectations and a Java test. The information was already in
+# the task graph and the job graph; the matrix was a third copy that had to be kept equal to both.
+
 on:
   pull_request:
   push:
@@ -21,9 +30,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
       - name: Require the committed public-path security baseline
         run: |
           set -euo pipefail
@@ -37,21 +43,22 @@ jobs:
             exit 1
           fi
       - uses: ./.github/actions/setup-gradle-java
-      - name: Check quality, public paths, and dependency locks
+      # `ci`, not `check`. A leaf's `check` is that leaf's — compile, its tests, Spotless, Checkstyle
+      # and Error Prone — and the repository-wide gates are named tasks of their own:
+      #   ci = every leaf check + architectureCheck + qualityCheck + configContractCheck
+      # so CI runs strictly more than it used to while `./gradlew :domain-core:check` runs strictly
+      # less.
+      - name: Run the pull-request gate
         working-directory: src
-        run: ./gradlew check verifyPublicPathSnapshot verifyDependencyLocks --warning-mode=fail --no-daemon --stacktrace
+        run: ./gradlew ci verifyPublicPathSnapshot verifyDependencyLocks --warning-mode=fail --no-daemon --stacktrace
       # build-logic is an included build: its own suite is not reachable from the root project's
-      # `check`, so the convention plugins every leaf applies shipped untested in CI. Kept as its
-      # own step rather than folded into the aggregate invocation above, which
-      # ConditionalTransportQualificationContractTest asserts on byte-for-byte.
+      # `check`, so the convention plugins every leaf applies would otherwise ship untested.
       - name: Test the build-logic convention plugins
         working-directory: src
         run: ./gradlew -p build-logic test --no-daemon --stacktrace
       # Named as its own step because nothing else runs it: `check` does not depend on
       # graphqlStableTest, so the lane's required-class guard — the check that its module-boundary
-      # suite has not silently stopped being discovered — protected nothing in CI. A separate step
-      # keeps the aggregate invocation below byte-identical, which ConditionalTransportQualification
-      # ContractTest asserts on, and the two tasks do not overlap.
+      # suite has not silently stopped being discovered — would protect nothing in CI.
       - name: Qualify the GraphQL Stable lane
         working-directory: src
         run: ./gradlew :adapter:inbound:graphql:graphqlStableTest --no-daemon --stacktrace
@@ -60,55 +67,33 @@ jobs:
         run: ./gradlew conditionalTransportQualification --no-daemon --stacktrace
 
   sample-off:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
-      - uses: ./.github/actions/setup-gradle-java
-      - name: Verify the application without the sample fixture
-        working-directory: src
-        run: ./gradlew :app-bootstrap:sampleOffTest verifyCleanArchitectureDependencies --no-daemon --stacktrace
-
-  gate-matrix-lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Verify the gate matrix against the repository
-        run: bash .github/scripts/verify-gate-matrix.sh
+    uses: ./.github/workflows/_reusable-gradle.yml
+    with:
+      tasks: ":app-bootstrap:sampleOffTest verifyCleanArchitectureDependencies"
 
   redis-sdk:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
-      - uses: ./.github/actions/setup-gradle-java
-      # Milestone A of the Redis wrapper/typed API plan: policy catalog, typed API parity,
-      # permit provenance, connection isolation, and the executor guard. There is no real-server
-      # lane yet — Tasks 10-17 add the contract suites that need one.
-      - name: Verify the Redis SDK policy, API parity, and guardrail contracts
-        working-directory: src
-        run: >-
-          ./gradlew
-          :shared-contract:edgeRateLimitContractTest
-          :adapter:outbound:cache-redis:check
-          verifyCleanArchitectureDependencies
-          verifyEnvKeys
-          verifyPublicPathSnapshot
-          verifyConfigurationPropertiesProcessor
-          --no-daemon --stacktrace
+    # Milestone A of the Redis wrapper/typed API plan: policy catalog, typed API parity, permit
+    # provenance, connection isolation, and the executor guard. There is no real-server lane yet.
+    #
+    # `verifyConfigurationPropertiesProcessor` used to be in this list. It is deleted: the parity it
+    # enforced — a leaf declares Spring's configuration processor exactly when it owns
+    # @ConfigurationProperties — is now what applying `ca.spring-config` means.
+    # `verifyEnvKeys` is no longer named here either; it belongs to :app-bootstrap and runs through
+    # `configContractCheck`, which the quality-gates job covers.
+    uses: ./.github/workflows/_reusable-gradle.yml
+    with:
+      tasks: >-
+        :shared-contract:edgeRateLimitContractTest
+        :adapter:outbound:cache-redis:check
+        :app-bootstrap:verifyEnvKeys
+        verifyCleanArchitectureDependencies
+        verifyPublicPathSnapshot
 
   jpa-candidate-evidence:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
       - uses: ./.github/actions/setup-gradle-java
       - name: Produce zero-skip JPA candidate manifests
         working-directory: src
@@ -125,25 +110,20 @@ jobs:
           if-no-files-found: error
           retention-days: 14
 
-  # Advisory only. Quarantine expiry/drift remains blocking through verifyQuarantineSunset in check.
+  # Advisory. The quarantine bucket runs so a flaky test is still executed and reported; it never
+  # blocks. The 14-day sunset registry that used to make an expired quarantine entry a build failure
+  # is gone — it was a 250-line YAML-and-Java parser guarding a registry with zero entries.
   quarantine:
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
-      - uses: ./.github/actions/setup-gradle-java
-      - name: Run quarantined tests as an advisory signal
-        working-directory: src
-        run: ./gradlew quarantineTest --no-daemon
+    uses: ./.github/workflows/_reusable-gradle.yml
+    with:
+      tasks: quarantineTest
+      gradle-args: "--no-daemon"
+      continue-on-error: true
 
   release-gate:
     needs:
       - quality-gates
       - sample-off
-      - gate-matrix-lint
       - redis-sdk
       - jpa-candidate-evidence
     if: always()
@@ -156,7 +136,6 @@ jobs:
         env:
           QUALITY_RESULT: ${{ needs.quality-gates.result }}
           SAMPLE_OFF_RESULT: ${{ needs.sample-off.result }}
-          MATRIX_RESULT: ${{ needs.gate-matrix-lint.result }}
           REDIS_RESULT: ${{ needs.redis-sdk.result }}
           JPA_CANDIDATE_RESULT: ${{ needs.jpa-candidate-evidence.result }}
         run: |
@@ -164,7 +143,6 @@ jobs:
           for result in \
             "${QUALITY_RESULT}" \
             "${SAMPLE_OFF_RESULT}" \
-            "${MATRIX_RESULT}" \
             "${REDIS_RESULT}" \
             "${JPA_CANDIDATE_RESULT}"; do
             if [[ "${result}" != "success" ]]; then
@@ -174,23 +152,16 @@ jobs:
           done
           echo "release-gate: all current blocking quality jobs succeeded."
 
-      # `needs` cannot reach another workflow, so every gate .github/ci-gate-matrix.yml marks
-      # release_blocking outside this file was invisible here: the field was read by nothing but an
-      # enum check in verify-gate-matrix.sh. filesystem-vulnerability-scan
-      # (dependency-vulnerability.yml::trivy-fs) is release_blocking: true and blocks on
-      # CRITICAL/HIGH and on the CISA KEV catalogue — it could be red while this job reported green
-      # and nothing in the repository joined the two.
+      # `needs` cannot reach another workflow, so a blocking check in another file has to be required
+      # by result. dependency-vulnerability.yml answers the same pull_request and push-to-main
+      # triggers as this workflow and trivy-fs carries no `if:` guard, so its check run always exists
+      # for this SHA — which is what makes it requirable rather than a matter of scheduling luck.
+      # Only `success` passes: a skipped or cancelled security scan is not a scan.
       #
-      # dependency-vulnerability.yml answers the same pull_request and push-to-main triggers as this
-      # workflow and trivy-fs carries no `if:` guard, so its check run always exists for this SHA.
-      # That is what makes it requirable by result rather than by scheduling luck. Only `success`
-      # passes: a skipped or cancelled security scan is not a scan.
-      #
-      # The other release_blocking gates outside this file run on triggers this job does not share
-      # and so cannot be required here without changing when they run: release.yml, jpa-release.yml
-      # and fileserver-release.yml answer a release tag, and object-storage-qualification.yml and
-      # messaging-certification.yml answer a path filter or a schedule. That is left as a stated gap
-      # rather than a silently different one.
+      # The release-tag and path-filtered workflows (release.yml, jpa-release.yml,
+      # fileserver-certification.yml, object-storage-qualification.yml, messaging-certification.yml)
+      # run on triggers this job does not share, so they cannot be required here without changing
+      # when they run. That is a stated gap, not a hidden one.
       - name: Require the cross-workflow release-blocking checks to have succeeded
         env:
           GH_TOKEN: ${{ github.token }}