ci(distributed): widen the trigger and drop the mid-suite image pull

The path allowlist covered 13 of the 99 packages the suite reaches. Commit
1dc3aeef8 touched core/config, core/services/modeladmin and core/backend and
matched no entry, so it would have merged without running the very specs that
cover it. Use the paths-ignore denylist tests-e2e.yml already uses.

Disable the testcontainers reaper: the runner is ephemeral, so the reaper buys
nothing and its unpinned image was pulled mid-suite, defeating the pre-pull.

Drop continue-on-error, which no other workflow uses and which reports a failed
run as green. The job is advisory by staying out of branch protection instead.
Pin Go to 1.26.0 to match go.mod, and add the tmate-on-failure step.

Assisted-by: Claude Opus 5 [claude-code]
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

.github/workflows/tests-e2e-distributed.yml

@@ -3,24 +3,15 @@ name: 'E2E Distributed Tests'
 
 on:
   pull_request:
-    paths:
-      - 'core/services/nodes/**'
-      - 'core/services/worker/**'
-      - 'core/services/messaging/**'
-      - 'core/services/syncstate/**'
-      - 'core/services/jobs/**'
-      - 'core/services/agents/**'
-      - 'core/services/agentpool/**'
-      - 'core/services/galleryop/**'
-      - 'core/http/routes/nodes.go'
-      - 'core/http/endpoints/localai/nodes.go'
-      - 'core/http/endpoints/openresponses/**'
-      - 'core/application/distributed.go'
-      - 'core/config/distributed_config.go'
-      - 'pkg/natsauth/**'
-      - 'tests/e2e/distributed/**'
-      - '.github/workflows/tests-e2e-distributed.yml'
-      - 'Makefile'
+    # The suite's dependency graph is 99 packages, so an allowlist of paths
+    # silently stops guarding the moment code moves. At ~75s the job is cheap
+    # enough to run unless the diff is confined to paths it provably cannot
+    # reach. See .agents/ci-caching.md.
+    paths-ignore:
+      - 'gallery/**'
+      - 'docs/**'
+      - 'examples/**'
+      - '**/*.md'
   push:
     branches:
       - master
@@ -32,10 +23,11 @@ concurrency:
 jobs:
   tests-e2e-distributed:
     runs-on: ubuntu-latest
-    # Advisory while the suite builds a track record. Flip to a required check
-    # only after it has run clean for two weeks; a heavy suite made required on
-    # day one gets disabled instead of fixed.
-    continue-on-error: true
+    # Advisory because it is deliberately not in branch protection, so a failure
+    # is a visible red X rather than a blocked merge. Promoting it to a required
+    # check is a repository-settings change, to be made once it has a track
+    # record; a heavy suite made required on day one gets disabled instead of
+    # fixed.
     timeout-minutes: 45
     steps:
       - name: Clone
@@ -47,7 +39,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.25.x'
+          go-version: '1.26.0'
           cache: false
       - name: Dependencies
         run: |
@@ -64,10 +56,26 @@ jobs:
       - name: Pre-pull test images
         # Pulling here rather than inside the suite keeps container-start timing
         # out of the spec timeouts and makes a registry outage read as a
-        # setup failure instead of a test failure.
+        # setup failure instead of a test failure. These two are the only images
+        # the suite needs once the testcontainers reaper is disabled below.
         run: |
           docker pull postgres:16-alpine
           docker pull nats:2-alpine
       - name: Distributed E2E
+        # TESTCONTAINERS_RYUK_DISABLED keeps the pre-pull above meaningful. The
+        # reaper exists to clean up leaked containers on a long-lived host, but
+        # this runner is ephemeral and every container dies with the VM. Leaving
+        # it enabled would pull a third, unpinned image (testcontainers/ryuk)
+        # from Docker Hub mid-suite: exactly the registry dependency the
+        # pre-pull step exists to remove.
+        env:
+          TESTCONTAINERS_RYUK_DISABLED: "true"
         run: |
           PATH="$PATH:$HOME/go/bin" make test-e2e-distributed
+      - name: Setup tmate session if tests fail
+        if: ${{ failure() }}
+        uses: mxschmitt/action-tmate@v3.23
+        with:
+          detached: true
+          connect-timeout-seconds: 180
+          limit-access-to-actor: true