The rest of ci-build.yaml installed its own toolchains: setup-go for the
unit tests and the e2e matrix, setup-node for the two UI jobs, setup-java
for the Java SDK suite, and an E2E Tools job that built k3d and Tilt and
handed them to the matrix as an artifact. None of those versions were the
ones a contributor develops against, so "it passes locally" and "it
passes in CI" were two unrelated claims.

Run them in the development shell instead. CI now compiles with the Go
go.mod asks for, bundles the UI with the Node the flake pins, and brings
the cluster up with the same k3d, kubectl and Tilt that `make start`
uses. The jobs where every step wants something from the shell — both e2e
jobs and the UI job — declare it once as the job's default shell rather
than prefixing each command with `nix develop`; the shared e2e composite
actions say it per step, because a composite action does not inherit its
caller's defaults.

The E2E Tools job goes entirely. It existed so that the k3d module proxy
and the Tilt release CDN were hit once rather than in ~14 parallel jobs,
which the binary cache now does instead. That also retires the
skip-cascade hazard its `if:` condition had to be kept a superset of.

setup-go, setup-node and setup-java cached Go, Yarn and Maven downloads
as a side effect, so put that caching back explicitly: the go-cache
action from the codegen and lint conversion, a new yarn-cache action, and
a Maven cache on the one matrix leg that builds with Maven. Nix caches
derivations, not incremental builds, so this stays GitHub-native.

Windows keeps setup-go: the flake has no Windows devShell.

Two tests only passed because of what the runner image happened to be.
Nix points TMPDIR at a directory whose name is 17 characters longer than
/tmp, which pushed the unix socket the artifact plugin tests bind under
`t.TempDir()` past the 108-byte sun_path limit; the shell hands TMPDIR
back to the platform default, next to the GOROOT it already unsets. And
`echo "...\c"` only means "no trailing newline" under dash: `sh` is bash
inside the shell, as it already is on macOS, so those two assertions use
`printf`, which means the same thing under both.

Maven itself still comes from the runner image, as it always did —
setup-java installed a JDK, not Maven — but the JDK is now the one the
flake pins beside the OpenAPI Generator that generates the client, so the
Java SDK builds against a current JDK rather than the EOL 8 it asked for.
The UI likewise builds on the flake's Node 22 rather than the 24 written
into the workflow; release.yaml still installs 24 until it moves to the
shell too.

Verified in the shell: yarn install, build, test, lint and deduplicate
all pass on Node 22 leaving the tree clean (130 UI tests); `go build
./...` and gotestsum both run off the shell's toolchain; and every
package `make test` failed in it now passes — workflow/artifacts/plugin,
workflow/executor/osspecific and cmd/argoexec/commands from the two fixes
above, util/sqldb and workflow/sync from a testcontainers image that had
not been pulled yet. golangci-lint is clean on the two packages touched,
and actionlint on ci-build.yaml.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H871PuNyYPzjmpUhXCRXGA
Signed-off-by: Alan Clucas <alan@clucas.org>