ci: shorten workflow display names so the README badges fit (ADR-1227)

[lusoris]

Summary

GitHub's badge.svg endpoint paints the workflow name: into the badge, so
the seven status badges at the top of the README render whatever the workflow is
called. Under ADR-0116 §2 that meant 60–70-character banners:

Tests & Quality Gates — Netflix Golden / Sanitizers / Tiny AI / Coverage   (72)
Security Scans — Semgrep / CodeQL / Gitleaks / Dependency Review           (64)
libvmaf Build Matrix — Linux/macOS/Windows/ARM × CPU/SYCL/CUDA             (62)
Upstream watcher — FFmpeg HIP hwdec (closes T-FFMPEG-HIP-FILTER-DEFERRED)  (73)

which wrapped the README header across several lines and crowded the Actions
sidebar and gh run list.

docs/development/ci-job-names.md already imposed a ≤30-character budget on
job display names for exactly this reason; workflow names were never brought
under it. ADR-1227 extends it
there, superseding ADR-0116 §2 (workflow name: only) and leaving every
other clause standing.

Fourteen workflows relabelled. The four the README badges point at — Tests,
Security, Builds, FFmpeg — are now named exactly as their badge link
labels, so the badge text and the link text finally agree. The axis list each
name carried moves to a comment under the name: line, where it doesn't have to
fit in a badge:

name: Security
# Security — Semgrep / CodeQL / Gitleaks / Dependency Review.
# The display name is deliberately short: GitHub's badge.svg paints it
# into the README status badge. See ADR-1227.

Filenames are untouched. Badge and Actions URLs key on the filename, so this
is label-only: no badge URL churn, no branch-protection re-pin (the single
required context is a job name, not a workflow name), and no workflow_run
trigger references any renamed workflow.

Reproducer / smoke-test command

# Every workflow name now fits the budget:
for f in .github/workflows/*.yml; do
  n=$(grep -m1 '^name:' "$f" | sed 's/^name: *//')
  [ ${#n} -gt 30 ] && echo "OVER BUDGET ${#n}: $f -> $n"
done; echo "checked"

# The aggregator contract is unaffected (job names, not workflow names):
scripts/ci/check-aggregator-names.sh
# -> OK: all 35 required checks in required-aggregator.yml match workflow definitions.

Deep-dive deliverables (ADR-0108)

• Research digest — no digest needed: the cause is one documented GitHub behaviour (badge.svg renders the workflow name) and the fix is a label edit.
• Decision matrix — ADR-1227 ## Alternatives considered (four options, including dropping the badges and abbreviating the axis list).
• AGENTS.md invariant note — no rebase-sensitive invariants; the non-obvious constraint (filenames are URL-bearing, names are not) is in the ADR and the ci-job-names doc.
• Reproducer / smoke-test command — above.
• Changelog fragment — changelog.d/changed/1227-short-workflow-display-names.md, CHANGELOG.md regenerated.
• Rebase note — no rebase impact: fork-local CI metadata, no upstream counterpart.

Docs (rule 10)

docs/development/ci-job-names.md gains a
"Workflow display names (ADR-1227)" section documenting the budget, why it is
sharper for workflow names than job names, and that filenames are exempt because
they are URL-bearing.

State (rule 13)

no state delta: CI metadata, no bug opened or closed.

🤖 Generated with Claude Code