No per-PR CI job builds or tests C++ outside the codegen paths

Build and test the C++ tree on a pull request, on at least one platform. The workflow that does build and test – codegen-drift.yml – is path-filtered to the inputs codegen reads, so a pull request that touches only C++ sources or tests checks out the tree, runs compass lint and stops.

A compile break is the cheapest defect to find and the most expensive to find late. Three reached main this sprint, each reddening the continuous builds until a hotfix landed: an FSM consumer that named a symbol the protocol header no longer declared, an IAM dataset handler that named a response field the generated type does not have, and a visibility macro on an enum that only Windows reports.

That last one shows the shape of the gap most sharply. No Linux or macOS compiler reports a symbol visibility attribute on an enum, so nothing outside a Windows run can find it, and Continuous Windows runs every twelve hours and takes five to eight. Without a build on the pull request, the only gates are the static checks, and a static check has to be written for each mistake after it happens.

A build on every pull request costs a vcpkg install and a full compile of the tree. A cheaper first step is a single preset, cached, on the platform that reports the most – or a merge queue.

• Story Hotfix: a visibility macro on an enum breaks the Windows build: the third instance, and the static check written in place of a build.
• Story Hotfix: a Boost library landed without its vcpkg port: the same cost argument – a check in front of the build rather than a build on the pull request.

• .github/workflows/codegen-drift.yml – the path filter in question.
• .github/workflows/header-hygiene.yml – a pull-request workflow added on 2026-09-29 for the one defect class that can be caught by reading sources.

The gate this asks for was built on 2026-09-29 (commit 17ad5c5335, environment prime_origin, task 4050BF6C) as pull-request-verify.yml plus the reusable cpp-verify.yml: a classifier over the changed paths, then a configure, a build of every target, ctest, and a service start, on every pull request that could break a build.

It was removed on 2026-09-30 by decision, and this capture is discarded with it. The cost was the problem: the job takes longer than everything else on a pull request put together, and the break it catches is one the author is about to find anyway. Building and starting the services belong on the developer's machine, where compass build, compass test run and compass services start already do exactly those steps.

Do not re-add it. The scheduled Continuous Linux job still configures, builds and tests the tree, so the estate is not unverified; it is verified off the pull-request path.