[iconidentify]

Lands the three CI fixes from the Namespace bring-up review.

1. package job: depmod / zstd missing

inspect-package.py shells out to depmod (and reads zstd-compressed modules), neither of which is on the Namespace image. Added a step to kernel-ci-jobs.yml that installs kmod and zstd before the package checks, guarded so it is a no-op where they already exist.

2. Reused artifacts must not come from PR runs (#165)

lookup-build.py now scopes reuse of kernel-package / kernel-verified artifacts to push, merge_group, schedule and workflow_dispatch runs only (REUSE_EVENTS). pull_request runs are still accepted as baselines (BASELINE_EVENTS), so a fork PR can never hand a reused kernel package into a trusted run. Covered by two new unit tests; full suite (110) green, actionlint + zizmor (pedantic) clean.

3. KUnit under KVM: announce_unbind_running_hotplug_test timeout

Root cause was a test-fixture gap, not an emulation artifact. The external-announce fixture never runs the driver's real init paths, so four work items the code under test later drains were left uninitialised and flushed with a NULL ->func:

• dcp_comp_unbind() drains dimensions_wq (driver inits it in dcp_modes_init()).
• dcp_disable_typec_work() drains typec_relink_wq, hdmi_settle_wq, hdmi_recheck_wq (driver inits them in its relink / HDMI setup).

Under TCG these only warned in __flush_work; under KVM the faster timing let the unbind diverge at that warning and miss the test's pause point, so the unbind test timed out on t->paused and the three typec-stop cases tripped unexpected __flush_work splats. The fixture now stubs all four works like the others, and the six now-unneeded apple-dcp-external-announce entries are dropped from kunit-expected.json. No --force-emulation workaround needed; this passes under KVM.

Labeled ci:build so the full build/KUnit/package/boot jobs run here.

🤖 Generated with Claude Code

[maralcbr]

Thanks, Chris. Already in via #169 (merged):

• kmod: same install step. zstd wasn't needed; the package job passed on Namespace without it (https://github.com/omacom/linux-aurora/actions/runs/39546961219).
• Reuse: ci: fix the Namespace run and reuse builds only from reviewed runs #169 is stricter. Besides excluding pull_request, it requires the run's branch to be integration/aurora (or its gh-readonly-queue branches) and drops kernel-ci-label.yml. Without the branch check, a writer's workflow_dispatch or push on their own branch would still run unreviewed workflow files and count as trusted. Baselines follow the same rule; push runs record metadata for every merged tree, so nothing is lost.