docs(workflows): make a dispatch description one readable line

An input description is what an operator reads in the dispatch form, one line
per input, exactly like a job or step name -- and it was drifting the other
way: eighteen of them opened with a bare word where every name in this
repository opens with an emoji, and sixteen ran past the line, the longest at
382 characters explaining four tor values inside a form field.

The descriptions now say what the input is; the workflow README says what the
values do. It gains the selection-token syntax and a table of the four tor
values, which is where a paragraph belongs when it outgrows its form field.

workflow_call inputs are left alone. They are wiring between workflows and are
rendered for nobody.

Two explanations did not survive the cut and are worth knowing: the mirror
cleanup no longer warns that the default GITHUB_TOKEN may lack the
delete:packages scope, and the workspace track no longer spells out that
'rotate' flips with the run number.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/README.md

@@ -128,8 +128,40 @@ An explicit `tor` input still wins over the full coverage: `enforced`,
 `exclusive` and `disabled` are operator narrowings, and a variant that pins
 `services.tor.enabled` to false never gets an onion run regardless.
 
+### Selection tokens
+
+An entry in `whitelist` or `priority` is a role name that MAY pin the axes the
+row would otherwise be assigned. Two spellings are accepted:
+
+| Form | Example |
+|---|---|
+| ASCII | `web-app-nextcloud#0,2@swarm+tor` |
+| the job label, pasted back out of the failed run | `🐳🧅网络应用·Nextcloud#0` |
+
+`#` selects variants (comma-separated), `@` the deploy mode, `+tor` /
+`+clearnet` the onion state. The onion state is spelled `+clearnet` rather than
+`-tor` because a role id may itself end in `-tor`.
+
+What a token leaves open belongs to the line it stands in: `priority` covers
+every remaining combination in one sweep, `whitelist` keeps the rotation and
+the row's position in the matrix. A pin the row cannot take — `@swarm` on a
+role without its own stack, `+tor` on a variant that pins
+`services.tor.enabled` false, or an axis that fights the run's own `mode` /
+`tor` input — aborts the matrix rather than dropping the row, because a dropped
+row would report a green run for a combination that never ran.
+
 ### Mode and tor
 
+The `tor` input decides what the onion axis is allowed to do at all:
+
+| Value | Effect |
+|---|---|
+| `auto` | rotates; a priority row covers both states in one sweep |
+| `enforced` | every capable row runs behind the onion |
+| `exclusive` | as `enforced`, and rows that cannot take an onion are dropped |
+| `disabled` | no row takes the onion |
+
+
 For **regular** rows both axes are a deterministic rotation over the row's
 position in the global list and the sweep number, never random, so a red job
 reproduces by re-running the same sweep:

.github/workflows/call-release-version.yml

@@ -11,7 +11,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: "Version tag to release (e.g. v1.2.3)"
+        description: "🏷️ Version tag to release (e.g. v1.2.3)"
         required: true
         type: string
 

.github/workflows/call-test-deploy.yml

@@ -82,17 +82,17 @@ on:
         type: string
         default: ""
       modes:
-        description: "🚀 Deploy modes rows may be drawn from: 'auto', or a subset of 'host compose swarm'."
+        description: "🚀 Deploy modes to draw from: 'auto' or a subset of 'host compose swarm'"
         required: false
         type: string
         default: "auto"
       filesystem:
-        description: "🗄️ Space-separated filesystems the per-distro pick draws from (ext4, btrfs, zfs). Empty: all three."
+        description: "🗄️ Filesystems the per-distro pick draws from. Empty: ext4, btrfs, zfs"
         required: false
         type: string
         default: ""
       tor:
-        description: "🧅 Tor axis: 'auto' rotates the onion over the capable rows, 'enforced' onions all of them, 'exclusive' drops the rows that cannot, 'disabled' onions none."
+        description: "🧅 Tor axis; see .github/workflows/README.md for what each value does"
         required: false
         type: choice
         default: auto

.github/workflows/call-test-dns.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       distros:
-        description: "Space-separated distro list (e.g. 'arch debian ubuntu')"
+        description: "🐧 Space-separated distro list (e.g. 'arch debian ubuntu')"
         required: false
         default: "debian"
         type: string

.github/workflows/call-test-instructions.yml

@@ -25,21 +25,21 @@ on:
   workflow_dispatch:
     inputs:
       distros:
-        description: "Space-separated distro list"
+        description: "🐧 Space-separated distro list"
         required: true
         type: string
       role:
-        description: "Role to test; empty picks one at random"
+        description: "📖 Role to test; empty picks one at random"
         required: false
         type: string
         default: ""
       priority:
-        description: "Space-separated app ids; a random one is preferred over whitelist"
+        description: "⭐ App ids; a random one is preferred over the whitelist"
         required: false
         type: string
         default: ""
       whitelist:
-        description: "Space-separated app ids; a random one is used when no role or priority is given"
+        description: "🎯 App ids; a random one runs when no role or priority is given"
         required: false
         type: string
         default: ""

.github/workflows/call-test-runner-smoke.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       ref:
-        description: "Git ref to check out (branch, tag, or SHA). Defaults to the repo default branch."
+        description: "🔀 Git ref to check out; empty takes the repo default branch."
         required: false
         default: ""
         type: string

.github/workflows/call-test-workspace.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       workspace_track:
-        description: "rotate splits the distros across compose and swarm and flips with the run number; compose or swarm pins every distro to that track"
+        description: "🧑‍💻 Track per distro: rotate splits compose/swarm, or pin one"
         type: choice
         default: rotate
         options: [rotate, compose, swarm]

.github/workflows/cron-images-cleanup-ci.yml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
     inputs:
       days:
-        description: "Delete CI images older than N days (default: 7)"
+        description: "🧹 Delete CI images older than N days (default: 7)"
         required: false
         default: "7"
         type: string

.github/workflows/cron-images-mirror-all.yml

@@ -7,21 +7,21 @@ on:
   workflow_dispatch:
     inputs:
       ghcr_namespace:
-        description: "GHCR namespace/org (default: repository owner)"
+        description: "🏛️ GHCR namespace/org (default: repository owner)"
         required: false
         type: string
       ghcr_prefix:
-        description: "GHCR repo prefix (default: mirror)"
+        description: "🏷️ GHCR repo prefix (default: mirror)"
         required: false
         default: "mirror"
         type: string
       repo_root:
-        description: "Repository root path (default: .)"
+        description: "📁 Repository root path (default: .)"
         required: false
         default: "."
         type: string
       images_per_hour:
-        description: "Optional throttle: max images mirrored per hour"
+        description: "⏱️ Optional throttle: max images mirrored per hour"
         required: false
         type: string
 

.github/workflows/entry-manual-mirror-cleanup.yml

@@ -4,17 +4,17 @@ on:
   workflow_dispatch:
     inputs:
       ghcr_namespace:
-        description: "GHCR namespace/org (default: repository owner)"
+        description: "🏛️ GHCR namespace/org (default: repository owner)"
         required: false
         type: string
         default: ""
       ghcr_prefix:
-        description: "Package name prefix to delete (default: mirror)"
+        description: "🏷️ Package name prefix to delete (default: mirror)"
         required: false
         type: string
         default: "mirror"
       visibility:
-        description: "Visibility filter: only packages with this visibility are deleted"
+        description: "👁️ Visibility filter: only these packages are deleted"
         required: false
         type: choice
         default: "private"
@@ -23,12 +23,12 @@ on:
           - public
           - internal
       dry_run:
-        description: "Dry-run: list packages that would be deleted without deleting them"
+        description: "🧪 Dry-run: list what would be deleted without deleting it"
         required: false
         type: boolean
         default: true
       token:
-        description: "Classic PAT with delete:packages scope. Leave empty to use the default GITHUB_TOKEN The default token may lack the delete:packages scope."
+        description: "🔑 Classic PAT with delete:packages. Empty: the default GITHUB_TOKEN"
         required: false
         type: string
         default: ""

.github/workflows/entry-manual-steer.yml

@@ -14,12 +14,12 @@ on:
         default: ""
         type: string
       priority:
-        description: "⭐ Roles to deploy first, in every combination left open (each variant × each offered mode × Tor and clearnet). Pin axes to narrow it: 'web-app-x#0,2@swarm+tor', or paste a job label back ('🚀🧅网络应用·Nextcloud#2'). They get chunks of their own; the regular rows wait until those are green."
+        description: "⭐ Roles to lead, in every combination left open (see README)"
         required: false
         default: ""
         type: string
       whitelist:
-        description: "🎯 Roles to deploy, in their normal matrix position. Same token syntax as ⭐, but what a token leaves open stays on the sweep rotation instead of being covered in full. Empty: diff vs origin/main. '__ALL__': every role."
+        description: "🎯 Roles to deploy. Empty: diff vs origin/main. '__ALL__': every role"
         required: false
         default: ""
         type: string
@@ -29,7 +29,7 @@ on:
         default: ""
         type: string
       mode:
-        description: "🚀 Deploy mode. 'auto' rotates every row over the modes its role offers; a single mode keeps only the rows that mode can take."
+        description: "🚀 Deploy mode. 'auto' rotates a row over the modes its role offers"
         required: false
         default: "auto"
         type: choice
@@ -39,12 +39,12 @@ on:
           - "compose"
           - "swarm"
       filesystem:
-        description: "🗄️ Space-separated filesystems the per-distro pick draws from (ext4, btrfs, zfs). Empty: all three."
+        description: "🗄️ Filesystems the per-distro pick draws from. Empty: ext4, btrfs, zfs"
         required: false
         default: ""
         type: string
       tor:
-        description: "🧅 Tor axis for swarm and compose. 'auto' onions every second tor-capable variant and flips with the run number, so two runs cover both states everywhere. 'enforced' onions every variant that can take one. 'exclusive' drops every variant that cannot, so the run tests the onion and nothing else. 'disabled' onions none. A variant pinning services.tor.enabled false is never eligible."
+        description: "🧅 Tor axis for swarm and compose; the four values are in the README"
         required: false
         default: "auto"
         type: choice
@@ -54,22 +54,22 @@ on:
           - "exclusive"
           - "disabled"
       resume_from_chunk:
-        description: "⏭️ Skip every chunk below this index. Use to continue a sweep after fixing what broke it, instead of re-running the green chunks."
+        description: "⏭️ Skip every chunk below this index after fixing what broke a sweep"
         required: false
         default: "0"
         type: string
       chunk_gate:
-        description: "🛑 Stop the chunk chain at its first failed chunk. Off: keep deploying the remaining chunks."
+        description: "🛑 Stop the chunk chain at its first failed chunk"
         required: false
         default: true
         type: boolean
       sweep:
-        description: "🔁 Sweep number driving the mode/tor rotation and the regular-line offset. Empty: the run number."
+        description: "🔁 Sweep number driving rotation and offset. Empty: the run number"
         required: false
         default: ""
         type: string
       workspace:
-        description: "🧑‍💻 Run the workspace test (dev-runtime image matrix). 'auto' runs it on a global scope only."
+        description: "🧑‍💻 Run the workspace test. 'auto': on a global scope only"
         required: false
         default: "auto"
         type: choice
@@ -78,7 +78,7 @@ on:
           - "true"
           - "false"
       workspace_track:
-        description: "🧑‍💻 Which workspace track each distro runs. 'rotate' splits them across compose and swarm and flips with the run number, so two runs cover both everywhere."
+        description: "🧑‍💻 Workspace track per distro. 'rotate' splits compose and swarm"
         required: false
         default: "rotate"
         type: choice
@@ -87,7 +87,7 @@ on:
           - "compose"
           - "swarm"
       instructions:
-        description: "📖 Run the instructions test (role README Production command). 'auto' runs it on a global scope only."
+        description: "📖 Run the instructions test. 'auto': on a global scope only"
         required: false
         default: "auto"
         type: choice