Install typediagram in the corpus workflow so the accuracy gate can build

[Wamwea]

TLDR

Installs the typediagram CLI in the corpus workflow so the real-repository accuracy gate can compile deslop-core and actually run — it had failed all three of its scheduled runs at build time, before scanning a single repository — and pins the invariant with a workflow-conformance E2E test. Closes #347.

Details

• .github/workflows/corpus.yml ([CORPUS-CI]): new Install typediagram step (npm install -g typediagram@0.11.0, matching ci.yml and make setup), placed after setup-node and before anything that compiles. deslop-core's build.rs shells out to typediagram to generate the IPC wire models, so every scheduled run died with spawnSync typediagram ENOENT ~70s in. Also aligns action pins with ci.yml: actions/checkout and actions/setup-node v4→v7 (clears the Node 20 deprecation warnings noted in Corpus accuracy gate has never run: corpus.yml omits the typediagram install, so build.rs fails before any repository is scanned #347), plus actions/cache v4→v6 (a drift the issue missed).
• New E2E test crates/deslop/tests/issue_347_workflow_typediagram_install.rs ([CORPUS-CI]): parses every .github/workflows/*.yml as YAML — no text pattern-matching — and asserts that every job invoking cargo or make installs typediagram before its first compiling step, pinned to the single version the Makefile setup target installs. This enforces the CLAUDE.md dependency-sync rule across ci.yml (4 jobs), corpus.yml, and release.yml in one place.
• New dev-dependency: yaml-rust2 = "=0.11.0", exact-pinned in the workspace table per convention; Cargo.lock change is purely additive (51 insertions, 0 deletions).
• Gate verified end-to-end locally: make test-corpus-ci (the exact command the workflow runs) completed for the scheduled slice and produced the harness's first-ever measurements — tokio: 758 files / 168,480 LOC / 1,713 clusters / 20.0% / 12.5s / 1,274 MB; nest: 1,726 files / 115,848 LOC / 1,220 clusters / 29.9% / 18.8s / 866 MB. The nest/determinism baseline (duplication_percent is nondeterministic across runs on an unchanged tree (0.191pp spread over 9 runs) — makes --fail-over CI gates flaky #301) reproduced exactly as recorded in corpus/known-failures.json ([KNOWN], clusters 1226 vs 1222) — its first confirmation by a completed run. No [NEW], no [FIXED?].

No public API, CLI flag, report format, or spec ID changes.

How Do The Automated Tests Prove It Works?

• workflows_that_compile_the_workspace_install_pinned_typediagram_first was verified red against the pre-fix corpus.yml (install step temporarily removed): it fails with corpus.yml job 'corpus' compiles the workspace but never installs typediagram — the exact Corpus accuracy gate has never run: corpus.yml omits the typediagram install, so build.rs fails before any repository is scanned #347 defect, not a setup error — and passes with the fix in place.
• Blind-audit guards: the test asserts the workspace-compiling set includes the corpus job, at least four ci.yml jobs, and the release.yml build job, so a predicate regression fails loudly instead of passing vacuously.
• The ordering assertion rejects an install step placed after the job's first cargo/make step (where the build would already have failed), and the version-shape assertion rejects non-exact pins such as typediagram@latest, which would satisfy version sync while abandoning pinning.
• The gate itself: before this fix, make test-corpus-ci aborted inside build.rs on any machine without a global typediagram; after it, the run completes and reports per-repository measurements (see Details).

Local make ci note: the shared working tree currently holds three untracked red-by-design accuracy tests from in-progress sessions (#298, #331, #342) plus the pre-existing timing-dependent cpu_throttle_knob failure (filed as #352), so the fail-fast local suite stops red on those external causes. Evidence that this diff is clean: all 119 other test binaries pass when run individually, full make lint is green, cargo clippy --all-targets is clean, and a Deslop self-scan reports zero duplication clusters involving the new test.