fix(ci): use hardlink copy instead of symlink for node_modules cache

After the bun.lock fix landed, the eval matrix STILL failed identically:
  Could not resolve: "smart-buffer" / "ip-address"
  at /opt/node_modules_cache/socks/build/client/socksclient.js

But the hash-tagged image actually contains smart-buffer + ip-address +
socks all flat in /opt/node_modules_cache (verified by pulling and
inspecting the image). 207 packages, all present.

Root cause: the workflow used `ln -s /opt/node_modules_cache node_modules`
to restore deps. Bun build (and Node module resolution generally) walks
a file's realpath to find sibling deps. From the symlinked
/workspace/node_modules/socks/build/client/socksclient.js, realpath
resolves to /opt/node_modules_cache/socks/build/client/socksclient.js,
and walking up to find a node_modules/smart-buffer dir fails — there's
no `node_modules` segment in the realpath.

Switch `ln -s` → `cp -al` (hardlink-copy). Each file in the cache becomes
a hardlink at /workspace/node_modules/<pkg>, sharing inodes (no data
copy). Realpath of /workspace/node_modules/socks/.../socksclient.js
stays inside /workspace/node_modules, so sibling deps resolve correctly.

Speed is comparable to symlink — `cp -al` on ~200 packages on tmpfs is
sub-second. Same caching story preserved.

Both evals.yml and evals-periodic.yml updated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/evals-periodic.yml

@@ -101,10 +101,14 @@ jobs:
             echo "TMPDIR=/home/runner/.cache"
           } >> "$GITHUB_ENV"
 
+      # Hardlink copy (cp -al) instead of symlink: bun build resolves a file's
+      # realpath when looking for sibling deps, which makes a symlinked
+      # /opt/node_modules_cache fail to resolve transitive deps. See
+      # evals.yml for the full explanation.
       - name: Restore deps
         run: |
           if [ -d /opt/node_modules_cache ] && diff -q /opt/node_modules_cache/.package.json package.json >/dev/null 2>&1; then
-            ln -s /opt/node_modules_cache node_modules
+            cp -al /opt/node_modules_cache node_modules
           else
             bun install
           fi

.github/workflows/evals.yml

@@ -110,11 +110,20 @@ jobs:
             echo "TMPDIR=/home/runner/.cache"
           } >> "$GITHUB_ENV"
 
-      # Restore pre-installed node_modules from Docker image via symlink (~0s vs ~15s install)
+      # Restore pre-installed node_modules from Docker image via hardlink copy.
+      # Why hardlinks instead of symlink: bun build (and Node module resolution
+      # in general) resolves a file's realpath when walking up to find
+      # node_modules/<dep>. With `ln -s /opt/node_modules_cache node_modules`,
+      # resolution from inside socks/build/client/socksclient.js walks the
+      # /opt/node_modules_cache/... realpath, where there is no parent
+      # node_modules dir containing smart-buffer/ip-address. With `cp -al`,
+      # each file's realpath is /workspace/node_modules/..., so sibling deps
+      # resolve correctly. Speed is comparable to symlink (hardlinks share
+      # inodes, no actual data copy).
       - name: Restore deps
         run: |
           if [ -d /opt/node_modules_cache ] && diff -q /opt/node_modules_cache/.package.json package.json >/dev/null 2>&1; then
-            ln -s /opt/node_modules_cache node_modules
+            cp -al /opt/node_modules_cache node_modules
           else
             bun install
           fi