[pchalamet]

make build now uses Terrabuild from PATH, and GitHub CI builds once before running seven test shards in parallel. Terrabuild restores prerequisites and successful test results from shared cache, then CI gathers reports into one result.

• Define the build graph and shared tool versions in WORKSPACE, including .NET SDK 10.0.403.
• Build and publish the toolchain image through Terrabuild's native Docker extension; reuse it from GHCR across runners.
• Publish TRX/JUnit summaries, cached test reports, and Terrabuild performance diagnostics. Group the build and test shards by workflow run and attempt in Insights.
• Split the FFI provider, renderer, and tests into graph projects; allow the teapot debugger's first breakpoint more startup time on busy runners. Update contributor documentation and changelog.

Validation:

• make build, make test-terrabuild, shard graph/coverage tests, changelog checks, and lint for the shared CI workflow passed locally.
• Full build, all seven test shards, and combined reports passed.
• CI for the latest commit is running. That commit renames shard targets from ci to test for Insights; local graph tests confirm the same checks remain selected.

Shared caching requires TERRABUILD_TOKEN and TERRABUILD_MASTER_KEY. Without both, runners use local caching. The toolchain currently includes WORKSPACE as an input, so workspace edits also invalidate the image and downstream caches.