[gouyt13]

Summary

• Fail C++ formatting when the file-list helper is missing, exits unsuccessfully, or emits partial output before failing. Preserve NUL-separated filenames and add regression coverage.
• Route allocation/failure test changes to C++ checks and formatting without unrelated Python or wheel builds.
• Use job-local ccache in Linux/macOS core/FastScan consumer jobs and the Clang matrix. Keep independent integration builds and the existing platform/OpenMP coverage, and report cache statistics.

ccache is a CI build tool only; library dependencies, APIs, and index formats are unchanged.

• Grant the metadata-only PR classifier pull-request write permission for label assignment/removal, while retaining issue write permission for repository label creation. Add permission regression assertions.

Testing

• python -B -m unittest discover -s .github/scripts -p 'test_*.py': 41 tests passed. Regression assertions failed against the original scripts and pass with these changes.
• python -m pytest tests/python/test_benchmark_protocol.py: 12 tests passed.
• tests/core_consumer/run.cmake: full GCC 14.3/OpenMP ON and Clang 23.1.4/OpenMP OFF runs passed, with 326 CTest cases each. Native optimization was disabled; build parallelism and OpenMP threads were both 2.
• Python formatting/lint, automation Ruff checks, ShellCheck, full C++ formatting, strict MkDocs build, and git diff --check passed.
• Actionlint 1.7.9 passed with its outdated windows-2025-vs2026 runner-label diagnostic narrowly ignored.
• A separate reviewer returned PASS for this exact patch, reran the automation and routing checks, reproduced the original defects, and inspected the raw integration evidence.

The clean Clang cache recorded 101 hits in 321 compiler calls. This confirms local compilation reuse; GitHub runtime improvement and macOS/Windows execution remain to be checked by this PR's CI.
The original PR classifier failed with HTTP 403 assigning a label. Its intended release:build label was applied and its retry passed. Because pull_request_target uses the base-branch workflow, this retry does not validate the new token permissions; that path must be confirmed after merge. The permission delta independently passed review and all local checks.