perf(ci): narrow native checks and deduplicate Rust qualification

[callumalpass]

Changes

• Editor-only PRs skip standalone CLI builds; CSS-only editor PRs also skip Windows Store packaging. Explicit releases retain all checks.
• Workspace formatting, feature validation, Clippy and Rust unit tests run once per hosted-provider Linux configuration, rather than in all six system shards. Qualification still requires the dedicated Rust job and all suites.
• Remove the mutable newest-release dependency from upgrade CI: verify the exact committed published fixture, annotated tag/commit and immutable image identity instead. Actual deployment-pair gates remain unchanged.
• Add regression tests and document policy.

Measured binary distribution

Run 35100242511 successfully transferred the 236 MiB artifact to six Linux runners: upload/compression 12s; downloads 7–19s; extraction/runtime probes 0–1s. Shard-local builds cost 132–189s each. However the existing Rust producer finishes after 454s, so waiting for it would worsen latency. Keep independent builds; a future build-first producer needs an end-to-end experiment. Detailed evidence: docs/ci-qualification.md.

Validation

• pnpm test and pnpm test:integration passed locally.
• 198 script tests pass after the release-policy fix.
• Live pinned-release verification passes despite newer releases.
• actionlint, YAML parsing and git diff --check pass.
• Full CI rerunning with ci:full after the release-policy fix; no bypasses or deployments.

[callumalpass]

Final verification for 2673d7c:

• Full Server CI succeeded: https://github.com/mdbase-dev/mdbase-connect/actions/runs/35101467976
• Desktop native/release checks succeeded: https://github.com/mdbase-dev/mdbase-connect/actions/runs/35101467283
• Both formerly blocked upgrade jobs now pass with the unchanged beta101 fixture, despite beta102 publication: server upgrade/OAuth 1m34s; provider historical/current recovery 9m18s.
• All six system suites, dedicated Rust checks, macOS/Windows durability and daemon lifecycle checks passed.
• Local pnpm test, pnpm test:integration, 198 script regressions, live pinned-release verification and actionlint passed.
• Binary sharing stays off by default: measured fan-out costs and dependency-path tradeoff are recorded in docs/ci-qualification.md. No CI bypass or deployment was used.

[callumalpass]

Resolved a second incoming conflict from #436, preserving its beta102 fixture identity and test-variable cleanup while retaining exact-tag (not newest-release) verification. All 198 script regressions pass. Removed the temporary ci:full label now that the experiment and full PR validation are complete: ordinary PR feedback remains fast and the required merge queue still performs full qualification on the combined candidate.

[callumalpass]

Merge-candidate run 35109046938 passed all lanes except Windows filesystem durability: unchanged test server::policy::tests::stuck_admitted_durable_work_does_not_delay_snapshot_or_publish_receipt failed started.elapsed() < Duration::from_millis(100). Core tests passed 150/150 and daemon tests 122/123. Classifying this one strict wall-clock assertion as a likely runner-timing flake and requeuing once; retaining the failed evidence and not changing assertions or qualification gates.