Relocate infra to $CODE/infra; keep $CODE as the workspace root

[krystophny]

What

Make this repository the infra directory of a workspace instead of the
workspace root, and retire the umbrella integration CI that never passed.

$CODE/            workspace root (no .git, no pollution)
  infra/          this repo            -> $INFRA
  external/       prebuilt third-party libs, shared by all codes
  libneo/ SIMPLE/  code checkouts (own .git)

• activate.sh/.fish export INFRA=$CODE/infra and derive CODE as its
  parent. Infra-private paths (scripts, .venv, modules) move to $INFRA.
• $CODE stays the workspace root, so the codes keep resolving dependencies as
  $CODE/<name> (find_or_fetch) and prebuilt libraries as $CODE/external.
• The two accidental gitlinks (SIMPLE, libneo) are dropped.
• main.yml is removed. It built the unpinned tips of six code repos in one
  sequential job and never went green (0 of 94 runs). The replacement model is
  in docs/development-model.md: per-code CI at the source plus release-time
  reverse-dependency validation owned by the upstream.

Migration for users

Move your checkout one level down and repoint the activation line:

mkdir ~/code.new && mv ~/code ~/code.new/infra && mv ~/code.new ~/code
# move the sibling checkouts (libneo, SIMPLE, ...) and external/ up next to infra
# then in ~/.bashrc: source $HOME/code/infra/activate.sh

Verification

New activation resolves correctly. Simulated workspace with infra at <ws>/infra
and a libneo/ sibling:

INFRA = /tmp/ws/infra
CODE  = /tmp/ws
venv  = /tmp/ws/infra/.venv
INFRA/scripts on PATH: yes
CODE/libneo/build on lib path: yes
find_or_fetch contract [ -d $CODE/libneo ]: PASS

Before/after on the dependency-resolution contract, with infra at <ws>/infra:

BEFORE: CODE=<ws>/infra -> $CODE/libneo = <ws>/infra/libneo -> absent, refetched
AFTER : CODE=<ws>       -> $CODE/libneo = <ws>/libneo       -> present, local

Verified locally on macOS: variable resolution, venv activation, PATH and
library-path entries, set_branch. CI is no longer the umbrella build; that
workflow is removed rather than fixed.

Note

docs/development-model.md is proposed, not settled. It documents the layout,
the <DEP>_BRANCH convention, the release-branch flow, and YY.MINOR.PATCH
versioning for group discussion. setup.yml (the release-tarball builder) is
left in place but loses its only consumer with main.yml gone, so it needs a
separate decision.

[slopqueue]

Review verdict: Request changes

Summary: This PR relocates the infra repository from the workspace root ($CODE) to a subdirectory ($CODE/infra), keeping $CODE as the workspace root so codes continue to resolve dependencies as $CODE/<name>. The change is mostly mechanical: ~30 files are updated to distinguish infra-private paths ($INFRA: scripts, .venv, modules) from workspace-level paths ($CODE: external libs, code checkouts). Two accidental gitlinks (SIMPLE, libneo) are dropped, and the umbrella CI (main.yml, 0/94 green) is retired in favor of a proposed per-code CI model documented in docs/development-model.md. The design is sound and the $CODE/$INFRA split is consistently applied across shell scripts, Dockerfiles, and the devcontainer flow. However, the fish activation script has a regression that breaks CODE resolution on older fish, and one comment actively contradicts its code.

Findings:

1. [blocker] activate.fish:20 — set -gx CODE (path resolve $INFRA/..) uses path resolve unconditionally, but lines 9-19 handle three cases for INFRA where path may not exist (fish < 3.5, no path builtin). On those systems INFRA is set via realpath or a cd/pwd fallback, but CODE tries path resolve, which fails — the command substitution returns an empty string, so CODE is set to "". Every subsequent $CODE reference breaks: add_to_library_path_fish $CODE/libneo/build is skipped (dir doesn't exist), CMAKE_INCLUDE_PATH gets a dangling $CODE/external/triangle, alias cdcode="cd $CODE" cds to $HOME. The old code on main set CODE through the same path/realpath/cd fallback as INFRA, so this is a regression. Fix: use the same fallback for CODE, e.g.:

if type -q path
    set -gx CODE (path resolve $INFRA/..)
else if type -q realpath
    set -gx CODE (realpath $INFRA/..)
else
    set -gx CODE (cd $INFRA/..; pwd)
end

2. [major] scripts/setup/stellopt.sh:5 — Comment says "That tree lives in the infra repo, so point it at $INFRA" but the code on line 6 sets CODE_ROOT="$CODE". The external tree is at $CODE/external (workspace), not in the infra repo ($INFRA/external doesn't exist). The comment contradicts the code: the code is correct (STELLOPT is cloned into $CODE/external/STELLOPT and reads $(CODE_ROOT)/external/...), but a future developer following the comment would "fix" it to $INFRA and break STELLOPT. Fix: update the comment to say the tree lives in the workspace at $CODE/external.

3. [minor] .github/workflows/setup.yml:84 — The TODO says "main.yml still consumes the pinned old release" but main.yml is deleted in this very PR (the umbrella CI being retired). The reference is stale. Fix: drop the main.yml clause or reword to "the pinned old release is still the latest tag; validate on a real tag before cutting the next one."

4. [minor] No CI — gh pr checks reports no checks on this branch (confirmed: check-runs API returns total_count: 0). The deleted main.yml never passed (0/94 runs, per the PR body), and setup.yml runs only on version tags — it is not exercised by PR CI. The setup.yml changes (building external deps in the workspace parent, copying into the tarball) are explicitly marked unvalidated ("Validate on a real tag before cutting the next release"). The PR body claims local verification of variable resolution and venv activation, but no automated CI exercises the changed activation, setup, or devcontainer paths. This is a process risk, not a code defect, but it means the changed paths are unproven beyond manual testing.

Verdict: request_changes — the activate.fish CODE regression (finding 1) breaks fish activation on any system without the path builtin, a configuration the script explicitly supports via the INFRA fallback. The fix is a one-liner. Finding 2 should also be fixed before merge to avoid a misleading comment that could cause a future breakage.