feat: S08.02 QEMU -icount determinism mode and analyze-iwyu required check

[DavidCozens]

Purpose

Closes #267 (S08.02 — Hello-world running under QEMU on CI).

S08.01 already wired build-freertos-target and build-freertos-host-tdd and (out-of-band) someone added them to branch protection. So the CI plumbing the story asks for is already in place. This PR tidies the two remaining loose ends, sized to David's "this hello-world is a stepping stone — don't over-engineer it" steer.

Change Description

• -icount shift=auto,sleep=off,align=off added to the qemu-system-arm invocation in build-freertos-target. Decouples FreeRTOS scheduler timing from CI runner load. No behavioural change for the current hello-world smoke (still races to print the greeting and gets killed by timeout 5), but it is the determinism mode the timing-sensitive BDD scenarios coming in S08.03+ will need, and it costs nothing now.
• analyze-iwyu added to required status checks on main via gh api. S24.01 added the job but the branch-protection update was missed.
• CLAUDE.md required-checks list synced with the actual GitHub state — adds analyze-iwyu, integration-windows-openssl, build-freertos-host-tdd, build-freertos-target to the documented list (they were all pinned but undocumented).
• DEVLOG.md appended per project cadence.

Deliberately not done

• No 10×-loop flake harness. The story's "ten consecutive runs without flake" criterion was aimed at the binary that BDD will eventually drive. Current hello-world is a stepping stone; subsequent E08 stories replace or evolve it. Real flake hardening belongs with S08.03 where BDD scenarios become the determinism evidence.
• No streaming-greeting detection rewrite. Same reason — timeout 5 / grep is fine for a stepping-stone smoke.
• No changes to Example/FreeRtos/HelloWorld/. Keeping the CI ELF identical to the dev-tested ELF stays load-bearing.

Test Evidence

• CI workflow change is observable on this PR's build-freertos-target job.
• Branch protection state verified after the gh api POST: analyze-iwyu now appears in required_status_checks.contexts.
• No code changes — no unit tests touched.

Areas Affected

• .github/workflows/ci.yml — single-job change to build-freertos-target.
• Branch protection on main (out of repo, applied via gh api).
• CLAUDE.md, DEVLOG.md — documentation only.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated CI/CD workflow to enhance FreeRTOS testing with improved instruction-count configuration for deterministic QEMU execution.
  • Expanded branch protection requirements to include additional automated checks (analyze-iwyu, integration-windows-openssl, build-freertos-host-tdd/build-freertos-target) for stricter code quality validation on pull requests.
  • Updated development documentation to reflect current CI requirements.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 70257ee1-9cfd-43f3-ab06-ce13a1a231cf

📥 Commits

Reviewing files that changed from the base of the PR and between b052c0e and ca02f31.

📒 Files selected for processing (3)

• .github/workflows/ci.yml
• CLAUDE.md
• DEVLOG.md

---

📝 Walkthrough

Walkthrough

This PR adds QEMU instruction-count determinism flags (-icount shift=auto,sleep=off,align=off) to the FreeRTOS target smoke-test command in CI, documents the expanded branch-protection required status checks in the contribution guide, and records the work in the devlog.

Changes

QEMU Determinism and CI Configuration

Layer / File(s)	Summary
QEMU Determinism Configuration .github/workflows/ci.yml	The qemu-system-arm invocation gains -icount shift=auto,sleep=off,align=off for deterministic guest timing, with inline documentation explaining the purpose and references to future BDD timing scenarios.
CI Status Check Documentation CLAUDE.md	Branch-protection required checks are expanded to include analyze-iwyu, integration-windows-openssl, and build-freertos-host-tdd/build-freertos-target alongside existing required checks.
Change Log DEVLOG.md	New entry for 2026-05-07 (S08.02) documents the QEMU determinism configuration, CI status-check requirements alignment, intentionally deferred work, and verification results.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• DavidCozens/solid-syslog#216: Updates CLAUDE.md branch-protection required checks (separate set of additions).
• DavidCozens/solid-syslog#261: Introduces the analyze-iwyu CI job that this PR adds to required checks.

Poem

🐰 A hop, a skip, through QEMU's clock,
With -icount we'll lock in the rock!
Determinism dwells where timing's steady—
The FreeRTOS target is nearly ready.
Branch checks align, the CI flows true. 🚀

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main changes: adding QEMU -icount determinism mode and the analyze-iwyu required check.
Description check	✅ Passed	The description covers all required template sections: Purpose (linked to #267), Change Description (detailed changes with rationale), Test Evidence (CI observable, verification done), and Areas Affected (specific files listed).
Linked Issues check	✅ Passed	The PR fulfills the scope of #267 by adding -icount to QEMU invocation for deterministic timing, configuring required check on main, and documenting changes. It does not implement out-of-scope BDD scenarios or syslog-ng wiring.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to #267 requirements: workflow modification for QEMU determinism, branch protection update, and documentation sync. No unrelated changes detected.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/s08-02-icount-iwyu-pin

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

☀️   Quality Summary

   🚦   build-linux-gcc: 100% successful (✔️ 1096 passed, 🙈 3 skipped)
   🚦   build-linux-clang: 100% successful (✔️ 1042 passed, 🙈 3 skipped)
   🚦   sanitize-linux-gcc: 100% successful (✔️ 1042 passed, 🙈 3 skipped)
   🚦   integration-linux-openssl: 100% successful (✔️ 9 passed)
   🚦   integration-windows-openssl: 100% successful (✔️ 9 passed)
   🚦   bdd-linux-syslog-ng: 100% successful (✔️ 46 passed)
   🚦   bdd-windows-otel: 96% successful (✔️ 44 passed, 🙈 2 skipped)
   🚦   build-windows-msvc: 100% successful (✔️ 954 passed, 🙈 1 skipped)
   ⚠️   Clang-Tidy: No warnings
   ⚠️   CPPCheck: No warnings

---

Created by Quality Monitor v1.14.0 (#f3859fd). More details are shown in the GitHub Checks Result.