[DeusData]

What does this PR do?

Adds a standalone FreeBSD build workflow, .github/workflows/freebsd.yml, that a maintainer starts by hand from the Actions tab (workflow_dispatch only, no schedule). It builds the headless binary (the C core, no embedded UI) inside FreeBSD 15.1 and 14.4 x86_64 VMs with the canonical scripts/build.sh CC=clang CXX=clang++, and then runs build/c/codebase-memory-mcp --version inside the VM. The UI build does not run there: its npm dependency tree pulls in onnxruntime-node, which publishes no FreeBSD build, so npm ci stops with EBADPLATFORM. The UI bundle itself is platform-independent JavaScript that every other leg already builds.

This is the shape agreed on #1422 on 25 September: a non-gating, manual-dispatch, informational job that gives us visibility into FreeBSD breakage without blocking anyone.

What this is not

• Not a gate: it is not part of the ci-ok aggregate and never runs on pull requests or pushes.
• Not part of a release: release.yml, dry-run.yml and _build.yml do not call it, and it uploads and publishes nothing, so no FreeBSD archive is ever released from it.
• Nothing new to trust: a standalone workflow with read-only permissions that nothing else calls.

Changes

• .github/workflows/freebsd.yml (new): FreeBSD 15.1 + 14.4 on x86_64, fail-fast: false, on an x86_64 ubuntu-latest host (QEMU guests on the arm runners are slow enough to time out). aarch64 stays disabled, with the reason in the file: it has not been proven with this workflow yet (its earlier blocker was the frontend build, which this headless job no longer runs). The VM prepare step installs only gmake, sqlite3, pkgconf and bash. actions/checkout uses the same v7.0.1 SHA pin as every other workflow here, with persist-credentials: false; vmactions/freebsd-vm is pinned to the full commit SHA of its current v1 release (v1.5.9). 90-minute timeout.
• scripts/env.sh: detects FreeBSD (freebsd* from uname -s) and sets MAKE=gmake there, because Makefile.cbm is GNU make syntax and FreeBSD's default make is BSD make; every other platform keeps make. The environment summary line now also prints make=....
• scripts/build.sh: the three build call sites run "$MAKE" instead of make. On macOS, Linux and Windows $MAKE is make, so those builds run exactly the command they ran before.

Credit

This carries forward #1422 by @PR9000, who did the real work: the release matrix, the x86_64-host choice with its in-file reasoning, the argued-out aarch64 exclusion, the vmactions VM approach with a SHA pin, fail-fast: false and the gmake detection. The commit is credited to them with a Co-authored-by trailer. It also builds on the FreeBSD groundwork that already landed in #1093, #1423 and #1467. Thank you!

What changed from #1422, and why:

1. The job lives in its own workflow instead of the reusable release build, so a FreeBSD red can never stop a release.
2. The packaging, attestation and upload steps are gone, because nothing from this job is published.
3. It builds the headless binary rather than the UI-embedded one: the UI's npm dependencies cannot install on FreeBSD (onnxruntime-node has no FreeBSD build), and the UI bundle is platform-independent and built on every other leg. That still proves the C core builds and starts on FreeBSD.
4. usesh is dropped (the current vmactions release documents it as ignored), and the VM copy-back is skipped because nothing reads the results afterwards.

Test plan

• FreeBSD proof run on this branch, via a temporary push: trigger commit that was dropped before this PR opened (the workflow it ran differs from the merged one only by those three trigger lines; the scripts are identical): https://github.com/DeusData/codebase-memory-mcp/actions/runs/41488878978 (15.1 and 14.4 green, make=gmake in the build summary, --version printed in each VM). An earlier run that still built the UI failed in both legs at npm ci (EBADPLATFORM), which is why the job builds headless.
• bash -n and shellcheck -x on scripts/env.sh and scripts/build.sh: env.sh is clean; build.sh shows only its pre-existing SC2163 on the CC/CXX export line.
• macOS: scripts/build.sh still builds the binary and --version runs; the expanded build command is the same make -j<N> -f Makefile.cbm cbm CFLAGS_EXTRA= as on main.
• The new workflow parses as YAML; the scripts/security-audit.sh pin check passes; tests/test_venue_parity_contract.sh passes with the new workflow marker-checked (re-run on the final tree, based on current main).
• pr.yml (ci-ok), release.yml, dry-run.yml, _build.yml, scripts/ci/select-lanes.sh and the security allowlists are byte-identical to main: the diff touches only the three files above.
• PR CI: dco + ci-ok.

Checklist

• Every commit is signed off (git commit -s)
• Tests pass locally (make -f Makefile.cbm test): not run; no C source changes, PR CI runs the full set
• Lint passes (make -f Makefile.cbm lint-ci): not applicable, cppcheck and clang-format cover C sources only
• New behavior is covered by a test: the FreeBSD proof run above exercises the new workflow and the gmake path end to end