DO NOT MERGE: probe the consolidated on-pr-ts-nx producer

[sidj-thr]

Reusing this closed PR rather than opening a new one.

Head carries fix/ts-checks-nx-consolidate plus two probe-only commits: the eight legacy on-pr--ts.yml are deleted so they cannot also produce the checks, and one marker file is added under packages/ocr-ggml so both on-pr-ts-nx and on-pr-nx fire on a packages/** change.

Expected: on-pr-ts-nx's matrix job computes the affected ts packages, only those static jobs run, and every check name on-pr-nx polls for appears and resolves in seconds rather than timing out at 25 minutes.

[github-actions]

License compliance — findings detected (warn-only)

Critical: 0 · High: 2 · Medium: 0

Dependency	License	Scope	Severity	Outcome
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd	(none detected)	runtime	High	blocks
actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f	(none detected)	runtime	High	blocks

How to resolve a blocking finding:

• Remove or replace the disallowed dependency, or
• If the license is genuinely acceptable, run the compliance SKILL and record the decision in .github/license-allowlist.yml (CODEOWNERS-reviewed), or
• For a one-off, a maintainer can apply the license-override label (High findings only; Critical cannot be overridden).

Warn-only (shadow) mode — this check does not block merges yet.

Updated automatically by the canonical license compliance workflow.

NOTICE presence (advisory)

Missing NOTICE (advisory, does not block):

• ./docs/website
• ./packages/fabric/test/integration
• ./packages/llm-llamacpp/benchmarks/server
• ./packages/llm-llamacpp/benchmarks/performance
• ./packages/inference-addon-cpp/mobile
• ./packages/asr-ggml/benchmarks/server
• ./packages/embed-llamacpp/benchmarks/server
• ./packages/embed-llamacpp/benchmarks/performance
• ./packages/sdk/e2e
• ./packages/vla-ggml/sim/server
• ./.github/actions/release-merge-guard

[github-actions]

Workflow security (shadow mode)

zizmor found 1108 finding(s) in .github/ (highest severity: high). This check is warn-only and does not block the merge.

Findings are annotated inline on the changed files and listed in the job summary.

Reproduce locally:

pipx run zizmor==1.27.0 --offline .github/

[sidj-thr]

Probe complete. Run 35060717782 (event=pull_request, so the definition came from this head) went green with publish-prebuild-status skipped instead of erroring. Closing; branch deleted. Tip was 1fe6043 if it needs restoring.

[sidj-thr]

Probe complete, both fixes verified. 1fe6043 (empty-matrix fix only) greened merge-guard with nothing verified; 3b3fc3a (both fixes) fails it with all four errors. Branch deleted.

[github-actions]

Review Status

Current Status: ❌ PENDING
Approvals so far: none

Pending reviews: Needs 1 Management or Team Lead, and 1 more from Management, Team Lead, or Member.

[sidj-thr]

Probe complete, folded into #4497. on-pr-ts-nx selected ["ocr-ggml"], ran that job only, skipped the other seven, and the await resolved. Branch deleted.