fix(storage): harden native publication policy

Author: DecisionNerd

.github/workflows/test.yml

@@ -865,16 +865,16 @@ jobs:
           cargo test -p graphforge-storage project_generation::tests:: --lib
           --no-fail-fast
 
-      - name: Run Windows native filesystem admission tests
+      - name: Run Windows exact filesystem primitive tests
         shell: bash
         run: >-
-          cargo test -p graphforge-storage
-          filesystem_admission::tests:: --lib --no-fail-fast
+          cargo test -p graphforge-filesystem --lib --no-fail-fast
 
-      - name: Run Windows exact filesystem primitive tests
+      - name: Run Windows native filesystem admission tests
         shell: bash
         run: >-
-          cargo test -p graphforge-filesystem --lib --no-fail-fast
+          cargo test -p graphforge-storage
+          filesystem_admission::tests:: --lib --no-fail-fast
 
       - name: Run Windows durability certification unit tests
         shell: bash
@@ -973,11 +973,13 @@ jobs:
           python3 scripts/ci/bazel-cache-perf.py --mode policy
           python3 scripts/ci/test-bazel-cache-perf.py
 
+      - name: Prepare Bazel evidence directory
+        run: mkdir -p dist
+
       - name: Authoritative Bazel Rust tests + first-party libs/CLI/resources
+        shell: bash
         run: |
-          set -euo pipefail
           # Do not set --remote_cache; Blacksmith injects repository cache.
-          mkdir -p dist
           bazelisk test --config=ci //:ci_rust_tests 2>&1 | tee dist/bazel-ci-rust-tests.log
           bazelisk build --config=ci \
             //:bazel_smoke \
@@ -1025,12 +1027,14 @@ jobs:
           sudo ln -sf /usr/local/bin/bazelisk /usr/local/bin/bazel
           bazelisk version
 
+      - name: Prepare Bazel diagnostic evidence directory
+        run: mkdir -p dist
+
       - name: Same-SHA Cargo/Bazel dual-build parity (diagnostic, one release cycle)
         run: |
           # Cargo is no longer authoritative under CI Gate (#4). Keep same-SHA
           # parity as a diagnostic for one release cycle; see cutover rollback doc.
           # Do not set --remote_cache; Blacksmith injects repository cache.
-          mkdir -p dist
           python3 scripts/ci/cargo-bazel-parity-check.py \
             --mode all \
             --write-evidence "dist/cargo-bazel-parity-evidence.json"