ci: restore deterministic offline test setup

Serialize network inventory validation after test preparation so parallel make
cannot inspect a tree while generated fixtures are changing. Preserve the
hidden offline bundle when transferring it between Linux CI steps.

Assisted-by: Codex:gpt-5

.github/workflows/test.yml

@@ -61,6 +61,7 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: test-resources-default-${{ github.run_id }}
+          include-hidden-files: true
           path: |
             .cache/test-resources/bundles/default.tar.zst
             test-resources/manifests/lock.json

Makefile

@@ -217,7 +217,8 @@ update-offline-test-cache:
 	$(GOCMD) run ./cmd/test-resources update "$(TEST_RESOURCE_SET)" "$(TEST_RESOURCE_MANIFESTS)" "$(TEST_RESOURCE_CACHE)"
 
 test: TEST_RESOURCE_SET=default
-test: test-network-lint prepare-test
+test: prepare-test
+	$(MAKE) test-network-lint
 	@echo 'Running tests'
 	export GO_TAGS="debug"
 	OPUS_SHIM_LIBRARY=$(abspath ./pkg/opus/shim/libopusshim.so) \
@@ -249,7 +250,8 @@ test-ci-scripts:
 ## --fail-fast so a single failure doesn't truncate the coverage number, and
 ## uses covermode=atomic so the result is deterministic. Prints the total.
 test-coverage: TEST_RESOURCE_SET=default
-test-coverage: test-network-lint prepare-test
+test-coverage: prepare-test
+	$(MAKE) test-network-lint
 	@echo 'Running tests with coverage (test failures stop before the percentage ratchet)'
 	GINKGO_TAGS="$(COVERAGE_TAGS)" \
 	COVERAGE_COVERPKG="$(COVERAGE_COVERPKG)" \