ci: gate the surfaces the default-feature run never sees

Three checks the workspace run silently skipped:

- `op-host-native --features gl-host` — 884 widget-host tests, the whole
  editor chrome. Never once run in CI.
- `op-engine-ffi --features editor` — its integration tests are
  `#![cfg(feature = "editor")]`, so the default run reports 0 tests. This
  is how the mobile safe-area band contract stayed red for eleven days
  after d20be2410 re-tinted the bands.
- clippy over CanvasKit / gl-host / editor, which had let a real
  collapsible_if sit in the web keyboard mount since 26b91658d.

Plus `check-file-line-cap.sh`, because the 800-line rule had no gate at
all and had drifted to eight violations.

One Linux leg carries them; Windows stays out for the same
DirectWrite/Skia reason as the existing test step.

.github/workflows/rust-check.yml

@@ -19,6 +19,7 @@ on:
       - 'tools/check-widget-boundary.sh'
       - 'tools/check-text-measure.sh'
       - 'tools/check-rustls-client-policy.sh'
+      - 'tools/check-file-line-cap.sh'
       - '.github/workflows/rust-release.yml'
       - '.github/workflows/rust-check.yml'
   push:
@@ -37,6 +38,7 @@ on:
       - 'tools/check-widget-boundary.sh'
       - 'tools/check-text-measure.sh'
       - 'tools/check-rustls-client-policy.sh'
+      - 'tools/check-file-line-cap.sh'
       - '.github/workflows/rust-release.yml'
       - '.github/workflows/rust-check.yml'
 
@@ -96,6 +98,7 @@ jobs:
           done
       - run: cargo fmt --all -- --check
       - run: tools/check-rustls-client-policy.sh
+      - run: tools/check-file-line-cap.sh
       - run: cargo build --workspace
       # GitHub-hosted runners are headless with no reliable Mesa software
       # EGL, so STEP1A_REQUIRE_GPU is left unset: the op-host-native GPU
@@ -132,7 +135,31 @@ jobs:
         run: cargo test --workspace --doc
       - name: Run CanvasKit web host tests
         run: cargo test -p op-host-web --features canvaskit -- --test-threads=1
+      # `gl-host` and `editor` are NON-DEFAULT features, so the workspace
+      # test step above compiles neither the native widget host (884 tests
+      # covering the entire desktop/mobile editor chrome) nor op-engine-ffi's
+      # editor-mode integration tests. That gap is exactly how the mobile
+      # safe-area band contract stayed red for eleven days after d20be2410
+      # re-tinted the bands. One Linux leg is enough to hold the contract;
+      # Windows is excluded for the same DirectWrite/Skia reason as above.
+      - name: Run native widget-host tests (non-default gl-host feature)
+        if: runner.os == 'Linux'
+        run: cargo test -p op-host-native --features gl-host
+      - name: Run engine-ffi editor-mode tests (non-default editor feature)
+        if: runner.os == 'Linux'
+        run: cargo test -p op-engine-ffi --features editor
       - run: cargo clippy --workspace --all-targets -- -D warnings
+      # The workspace clippy above only sees DEFAULT features, so the
+      # CanvasKit web host, the native widget host and the FFI editor mode
+      # are all invisible to it — a real `collapsible_if` sat in
+      # `canvaskit/mount_keyboard.rs` from 26b91658d until 0827 for exactly
+      # that reason. Lint those three surfaces explicitly.
+      - name: Clippy non-default feature surfaces
+        if: runner.os == 'Linux'
+        run: |
+          cargo clippy -p op-host-web --features canvaskit --all-targets -- -D warnings
+          cargo clippy -p op-host-native --features gl-host --all-targets -- -D warnings
+          cargo clippy -p op-engine-ffi --features editor --all-targets -- -D warnings
       # Step 1a Phase C Task 4: spec v19 §11 + §12.3 boundary invariants.
       # Linux runner has the full mobile target stdlib (`rustup target add`
       # in subsequent steps would handle ios/android cargo metadata too,

tools/check-file-line-cap.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# CLAUDE.md's 800-line-per-file convention, enforced.
+#
+# The cap had drifted to eight violations by 2026-08-27 (paint.rs 911,
+# tests.rs 894, lib.rs 868, …) precisely because nothing checked it — the
+# doc claimed "zero violations" while the tree said otherwise. Splitting is
+# a spine plus sibling files with re-exports keeping import paths stable;
+# see CLAUDE.md's "Code Style" section.
+set -euo pipefail
+
+cap=800
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$root"
+
+violations="$(find crates -name '*.rs' -not -path '*/target/*' -exec wc -l {} + \
+  | awk -v cap="$cap" '$2 != "total" && $1 > cap { print $1 " " $2 }' | sort -rn)"
+
+if [[ -n "$violations" ]]; then
+  echo "::error::files exceed the ${cap}-line cap (CLAUDE.md Code Style):"
+  echo "$violations" | sed 's/^/  /'
+  exit 1
+fi
+echo "file line cap OK (no crates/**/*.rs over ${cap} lines)"