Run the CI parity guard in both runners

The guard that keeps "local green" and "GitHub green" meaning the same thing was invoked by nothing. Its only entry point was an exec behind an explicit --check-parity flag, which by exec-ing could not be combined with an actual run, and no workflow step called it at all. A guard nobody runs is a guard that does not exist, which is how the mixed-profile divergence on next survived unnoticed.

It now runs as the first stage of every local run and as its own job on GitHub. Locally it reports through the same result-recording path as every other stage, so a divergence sets the run's exit status instead of scrolling past. It is deliberately placed above the mode branches, so a divergence also fails --only, --test-only and --build-only runs: whichever subset was asked for, the claim that a local result means what a GitHub result means is what has broken. The GitHub side installs pyyaml explicitly rather than assuming the runner image carries it.

--check-parity keeps working exactly as before. Three comment blocks that described the old folded comparison are corrected here, in the workflow, the local runner and the testing README; they were spread across three files and only two mention the guard by name, so the third is best found by searching for what it claims rather than for the script.

.github/workflows/ci.yml

@@ -38,12 +38,12 @@ env:
 #                    unreliable on GitHub-hosted runners.
 #   tor-directory  — same; live Tor dependency.
 #
-# Granularity-only differences (same coverage, different matrix shape —
-# NOT a divergence):
-#   deb-install    — split here into per-distro legs (debian12/debian13/
-#                    ubuntu22/ubuntu24/ubuntu26) for parallelism; local runs the
-#                    same distro set in one suite.
-#   dns-resolver   — single leg here; runs all scenarios (same as local).
+# The two runners express the same work in different matrix shapes, and the
+# parity guard compares through that shape rather than around it: chaos legs
+# are compared per scenario (and per flag) via their `scenario:` field,
+# deb-install legs per distro. The one leg still compared at leg granularity
+# is dns-resolver — a single leg here, running all of its scenarios
+# internally, exactly as the local suite does.
 # ─────────────────────────────────────────────────────────────────────────────
 
 # ─────────────────────────────────────────────────────────────────────────────
@@ -52,6 +52,16 @@ env:
 # Builds on Linux x86_64, Linux aarch64, and macOS.
 # ─────────────────────────────────────────────────────────────────────────────
 jobs:
+  ci-parity:
+    name: CI parity
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Install Python deps
+        run: pip3 install --quiet pyyaml
+      - name: Check local and GitHub runners cover the same work
+        run: bash testing/check-ci-parity.sh
+
   fmt:
     name: Format check
     runs-on: ubuntu-latest