feat(solver): graph decomposition for cluster-by-cluster solving (phase 3)

Add a Python decomposition layer using NetworkX that partitions the
constraint graph into biconnected components (rigid clusters), orders
them via a block-cut tree, and solves each cluster independently.
Articulation-point bodies propagate as boundary conditions between
clusters.

New module kindred_solver/decompose.py:
- DOF table mapping BaseJointKind to residual counts
- Constraint graph construction (nx.MultiGraph)
- Biconnected component detection + articulation points
- Block-cut tree solve ordering (root-first from grounded cluster)
- Cluster-by-cluster solver with boundary body fix/unfix cycling
- Pebble game integration for per-cluster rigidity classification

Changes to existing modules:
- params.py: add unfix() for boundary body cycling
- solver.py: extract _monolithic_solve(), add decomposition branch
  for assemblies with >= 8 free bodies

Performance: for k clusters of ~n/k params each, total cost drops
from O(n^3) to O(n^3/k^2).

220 tests passing (up from 207).

GNN/.gitea/workflows/ci.yaml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [main, public]
+    branches: [main]
   pull_request:
-    branches: [main, public]
+    branches: [main]
   workflow_dispatch:
     inputs:
       run_datagen:
@@ -37,14 +37,14 @@ jobs:
     env:
       PATH: /tmp/solver-venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
     steps:
-      - name: Checkout
+      - name: Trust internal CA
         run: |
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
-            "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE" \
-            || git clone --depth 1 "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE"
-          cd "$GITHUB_WORKSPACE"
-          git checkout "$GITHUB_SHA" 2>/dev/null || true
+          curl -sk https://ipa.kindred.internal/ipa/config/ca.crt \
+            -o /usr/local/share/ca-certificates/kindred-internal.crt
+          update-ca-certificates
+
+      - name: Checkout
+        uses: https://github.com/actions/checkout@v4
 
       - name: Set up venv
         run: python3 -m venv $VIRTUAL_ENV
@@ -66,23 +66,24 @@ jobs:
     env:
       PATH: /tmp/solver-venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
     steps:
-      - name: Checkout
+      - name: Trust internal CA
         run: |
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
-            "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE" \
-            || git clone --depth 1 "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE"
-          cd "$GITHUB_WORKSPACE"
-          git checkout "$GITHUB_SHA" 2>/dev/null || true
+          curl -sk https://ipa.kindred.internal/ipa/config/ca.crt \
+            -o /usr/local/share/ca-certificates/kindred-internal.crt
+          update-ca-certificates
+
+      - name: Checkout
+        uses: https://github.com/actions/checkout@v4
 
       - name: Set up venv
         run: python3 -m venv $VIRTUAL_ENV
 
       - name: Install dependencies
         run: |
-          pip install --cache-dir $PIP_CACHE_DIR torch --index-url $TORCH_INDEX
+          pip install --cache-dir $PIP_CACHE_DIR \
+            mypy numpy scipy \
+            torch --index-url $TORCH_INDEX
           pip install --cache-dir $PIP_CACHE_DIR torch-geometric
-          pip install --cache-dir $PIP_CACHE_DIR mypy numpy scipy
           pip install --cache-dir $PIP_CACHE_DIR -e ".[dev]"
 
       - name: Mypy
@@ -96,21 +97,22 @@ jobs:
     env:
       PATH: /tmp/solver-venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
     steps:
-      - name: Checkout
+      - name: Trust internal CA
         run: |
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
-            "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE" \
-            || git clone --depth 1 "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE"
-          cd "$GITHUB_WORKSPACE"
-          git checkout "$GITHUB_SHA" 2>/dev/null || true
+          curl -sk https://ipa.kindred.internal/ipa/config/ca.crt \
+            -o /usr/local/share/ca-certificates/kindred-internal.crt
+          update-ca-certificates
+
+      - name: Checkout
+        uses: https://github.com/actions/checkout@v4
 
       - name: Set up venv
         run: python3 -m venv $VIRTUAL_ENV
 
       - name: Install dependencies
         run: |
-          pip install --cache-dir $PIP_CACHE_DIR torch --index-url $TORCH_INDEX
+          pip install --cache-dir $PIP_CACHE_DIR \
+            torch --index-url $TORCH_INDEX
           pip install --cache-dir $PIP_CACHE_DIR torch-geometric
           pip install --cache-dir $PIP_CACHE_DIR -e ".[train,dev]"
 
@@ -118,35 +120,45 @@ jobs:
         run: pytest tests/ freecad/tests/ -v --tb=short
 
   # ---------------------------------------------------------------------------
-  # Dataset generation — manual trigger or on main/public push
+  # Dataset generation — manual trigger or on main push
   # ---------------------------------------------------------------------------
   datagen:
     runs-on: ubuntu-latest
     if: >-
       (github.event_name == 'workflow_dispatch' && inputs.run_datagen == true) ||
-      (github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/public'))
+      (github.event_name == 'push' && github.ref == 'refs/heads/main')
     needs: [test]
     env:
       PATH: /tmp/solver-venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
     steps:
-      - name: Checkout
+      - name: Trust internal CA
         run: |
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
-            "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE" \
-            || git clone --depth 1 "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE"
-          cd "$GITHUB_WORKSPACE"
-          git checkout "$GITHUB_SHA" 2>/dev/null || true
+          curl -sk https://ipa.kindred.internal/ipa/config/ca.crt \
+            -o /usr/local/share/ca-certificates/kindred-internal.crt
+          update-ca-certificates
+
+      - name: Checkout
+        uses: https://github.com/actions/checkout@v4
 
       - name: Set up venv
         run: python3 -m venv $VIRTUAL_ENV
 
       - name: Install dependencies
         run: |
-          pip install --cache-dir $PIP_CACHE_DIR torch --index-url $TORCH_INDEX
+          pip install --cache-dir $PIP_CACHE_DIR \
+            torch --index-url $TORCH_INDEX
           pip install --cache-dir $PIP_CACHE_DIR torch-geometric
           pip install --cache-dir $PIP_CACHE_DIR -e ".[train]"
 
+      - name: Restore datagen checkpoint
+        id: datagen-cache
+        uses: https://github.com/actions/cache/restore@v4
+        with:
+          path: data/synthetic
+          key: datagen-${{ github.sha }}
+          restore-keys: |
+            datagen-
+
       - name: Generate dataset
         run: |
           NUM=${INPUTS_NUM_ASSEMBLIES:-100000}
@@ -160,6 +172,23 @@ jobs:
           INPUTS_NUM_ASSEMBLIES: ${{ inputs.num_assemblies }}
           INPUTS_NUM_WORKERS: ${{ inputs.num_workers }}
 
+      - name: Save datagen checkpoint
+        if: always()
+        uses: https://github.com/actions/cache/save@v4
+        with:
+          path: data/synthetic
+          key: datagen-${{ github.sha }}
+
+      - name: Upload dataset
+        uses: https://github.com/actions/upload-artifact@v3
+        with:
+          name: synthetic-dataset
+          path: |
+            data/synthetic/index.json
+            data/synthetic/stats.json
+            data/synthetic/shards/
+          retention-days: 90
+
       - name: Print summary
         if: always()
         run: |