Strict escalates consumer invalid-pch, re-probes cached headers everywhere, and defaults the matrix to strict

.github/workflows/ci-docker.yml

@@ -202,22 +202,17 @@ jobs:
           - ln882x-arduino
           - nrf52
           - host
-        # Fail the job if the precompiled header silently degrades on the
-        # platforms where it must work. Excluded: bk72xx/rtl87xx/ln882x
-        # (libretiny GCC rejects its own pch until a toolchain bump),
-        # esp32-*-platformio (no pch; the toolchain is being dropped),
-        # nrf52 and host (no pch)
+        # Strict by default so a new matrix id cannot silently join in the
+        # degrade-quietly mode the knob exists to catch; the knob is inert
+        # where no pch code runs (esp32-*-platformio, nrf52, host).
+        # Opt-outs: libretiny GCC rejects its own pch until a toolchain bump.
         include:
-          - id: esp8266-arduino
-            pch_strict: "1"
-          - id: esp8266-arduino-native
-            pch_strict: "1"
-          - id: esp32-idf-esp-idf
-            pch_strict: "1"
-          - id: esp32-arduino-esp-idf
-            pch_strict: "1"
-          - id: rp2040-arduino
-            pch_strict: "1"
+          - id: bk72xx-arduino
+            pch_strict: "0"
+          - id: rtl87xx-arduino
+            pch_strict: "0"
+          - id: ln882x-arduino
+            pch_strict: "0"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Download image artifact
@@ -229,7 +224,7 @@ jobs:
       - name: Compile ${{ matrix.id }}
         run: |
           docker run --rm \
-            -e ESPHOME_PCH_STRICT="${{ matrix.pch_strict || '0' }}" \
+            -e ESPHOME_PCH_STRICT="${{ matrix.pch_strict || '1' }}" \
             -v "${{ github.workspace }}/docker/test_configs:/config" \
             "ghcr.io/esphome/esphome-amd64:${{ needs.check-docker.outputs.tag }}" \
             compile "${{ matrix.id }}.yaml"