fix(ci): always run tests, remove needs:[] so tag waits for passing tests

Two bugs in the previous CI:
- needs: [] on the tag job bypassed stage ordering — tags were created before
  tests finished, defeating the entire pull-based deploy safety guarantee
- changes: rules meant a push to infra/ or docs would skip all tests but still
  create a tag

Now matches the padelnomics pattern: all three test jobs always run on master
and MRs, tag job runs after the test stage completes (stage ordering, no needs).
Also use uv sync --all-packages consistently across all jobs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitlab/.gitlab-ci.yml

@@ -13,68 +13,52 @@ cache:
 
 .uv_setup: &uv_setup
   - curl -LsSf https://astral.sh/uv/install.sh | sh
-  - export PATH="$HOME/.cargo/bin:$PATH"
   - source $HOME/.local/bin/env
 
 workflow:
   rules:
     - if: $CI_PIPELINE_SOURCE == "merge_request_event"
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-    - if: $CI_COMMIT_TAG
 
-# --- Data platform ---
+# ── Tests ─────────────────────────────────────────────────────────────────────
 
 test:cli:
   stage: test
   before_script:
     - *uv_setup
   script:
-    - uv sync
-    - uv run pytest tests
-  rules:
-    - changes:
-        - src/**/*
-        - tests/**/*
-        - pyproject.toml
+    - uv sync --all-packages
+    - uv run pytest tests/
 
 test:sqlmesh:
   stage: test
   before_script:
     - *uv_setup
   script:
-    - uv sync
+    - uv sync --all-packages
     - cd transform/sqlmesh_materia && uv run sqlmesh test
-  rules:
-    - changes:
-        - transform/**/*
-
-# --- Web app ---
 
 test:web:
   stage: test
   before_script:
     - *uv_setup
   script:
-    - uv sync
+    - uv sync --all-packages
     - cd web && uv run pytest tests/ -x -q
     - cd web && uv run ruff check src/ tests/
-  rules:
-    - changes:
-        - web/**/*
 
-# --- Deploy (pull-based via supervisor) ---
-# The on-server supervisor (src/materia/supervisor.py) polls for new tags
-# every 60s and deploys automatically when a new v<N> tag appears.
-# No SSH keys, no deploy credentials needed in CI.
+# ── Tag (pull-based deploy) ───────────────────────────────────────────────────
+# Creates v<N> tag after all tests pass. The on-server supervisor polls for new
+# tags every 60s and deploys automatically. No SSH keys or deploy credentials
+# needed in CI — only the built-in CI_JOB_TOKEN.
 
 tag:
   stage: tag
   image: alpine:latest
-  needs: []
   before_script:
     - apk add --no-cache git
   script:
     - git tag "v${CI_PIPELINE_IID}"
     - git push "https://gitlab-ci-token:${CI_JOB_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git" "v${CI_PIPELINE_IID}"
   rules:
-    - if: $CI_COMMIT_BRANCH == "master"
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH