Sweep #1950: no-apt matcher, hook rebuild-0, genkit tests and docs - #1960

Summary

• No-apt CI test now sees apt through with: inputs and local composite actions, and anchors its uses: match (Close the 0.19.7 test gaps from #1938 #1948 audit).
• Hook-test and CI-test fixes below; the N4 test is in the companion high-risk PR.
• Hook test reads a bare previous-companion pin as rebuild 0 of its line (Accept the previous LiteRT-LM companion template for earlier-rebuild pins (#1934) #1946 audit, mutant M1).
• Genkit: test the CHANGELOG date-format checks in both release workflows (Prepare genkit_llamadart 3.9.0 release #1955); assert structured output forwards template.grammar (mutant M-G); document that an unset forcedMessage becomes a lone \n and native-chat backends get no prefix (genkit_llamadart: resolve the thinking budget through core (#1929) #1952).
• Docs: genkit size-check coverage and the pubspec limit constant (Check pubspec size and genkit in the release verifier; test LiteRT remover guards (#1935) #1947 audit); guide wording for which grammars wait during a budget (Keep the response-format grammar applied through a budgeted forced-open thought #1956 audit).

Tracks #1950; does not close it.

Production-readiness scope

• User-facing scope: Tests, tooling and docs only; no runtime behavior change.
• Supported platforms/paths: CI, maintainer docs, genkit package docs.
• Unsupported or intentionally unavailable paths: N/A
• Out of scope / follow-ups: The drift gate and Dartdoc/matrix nits are in the companion high-risk PR; Linux pidfd re-measure, real-model LiteRT-LM e2e skip and Streaming partial parses differ from the final parse by chunking (MiniMax M3, thinking tags, Gemma 4) #1930 stay open in 0.19.8 audit follow-ups #1950.

Completeness checklist

• Declared scope is fully implemented, or explicitly reduced above.
• Unsupported platform/option combinations fail loudly with actionable diagnostics or are clearly documented as unavailable. (N/A, no runtime change)
• Public API docs, README/website docs, examples, support matrices, and changelog entries are updated where relevant. (docs updated; no changelog entry, nothing user-observable)
• Regression coverage covers the original issue plus key negative/version-skew paths where relevant.
• Public capability changes update the validation coverage registry. (N/A)
• Security/privacy review completed: no secrets, tokens, signed URLs or secret-bearing paths touched.
• Follow-up work is tracked in 0.19.8 audit follow-ups #1950.

PR type guidance

• Docs-only PR: N/A, mixed tests/tooling/docs; no runtime behavior changes. Docs validated with ./tool/docs/build_site.sh.

Mutation check

| M1 bare pin read as another release line | build_hook_litert_lm_integration_test.dart _rebuildOnLine | killed |
| M1b rebuild number ignored | same | killed |
| Date-format check replaced by always-pass, release and publish workflows | test/ci/test_genkit_release.py | killed (2 of 2) |
| M-G grammar: template.grammar -> null | genkit structured JSON test | killed |

Test Plan

• dart run tool/prepare_workspace.dart
• dart format --output=none --set-exit-if-changed .
• dart analyze
• dart test -p vm -j 1 --exclude-tags local-only N/A locally: ran test/unit/tooling/, the hook test, test/ci unittest and the Markdown suites; full lane in CI
• dart test -p chrome --exclude-tags local-only N/A, no web paths
• coverage-lib N/A, no lib/ change
• Other: ./tool/docs/build_site.sh; genkit test/integration/genkit/actions/model_action (99 pass)

Matrix Evidence

Review Notes

• Independent review status: N/A, standard risk
• CI status / head SHA: see checks

High-risk regression review

• Classification: standard
• Implementation task: N/A
• Independent blocking QA task: N/A
• Exact head / current base: N/A
• Production-branch deletion, bypass, or miswire proof: N/A
• Affected-family real-model/artifact evidence: N/A
• Explicit unavailable-family or other N/A evidence: N/A
• Known PR-caused P1 regressions: 0
• Unresolved review threads: 0