ci: reduce pull request runner usage

[Astro-Han]

Summary

Reduce automatic pull request runner starts to one stable core gate.

• Run planning, planner contract tests, lint/format, build/typecheck, affected workspace tests, Runtime Host tests, Electron E2E/alignment, and Storybook as selected steps in one Ubuntu test job.
• For changes that can affect the published CLI, build and validate an installed Linux/Node 24 tarball in that same job. The planner is the single authority for selecting this check.
• Keep the full CLI matrix, including macOS, Windows, Node 22, and real Harbor/Pier validation, available through manual dispatch and the release workflow_call; it no longer starts automatically for pull requests.
• Keep Windows baseline on its existing nightly schedule and manual dispatch. Keep Windows recovery on manual dispatch. Neither starts automatically for pull requests.
• Run the core job for pull requests and main pushes. The main run validates the exact merged delta because this repository does not currently require pull requests to stay up to date with the base branch.

For this PR's own CI-sensitive diff, the automatic path changes from nine jobs to CI / test only. The tradeoff is less platform evidence on every pull request and less lane-level parallelism; the retained installed-package smoke covers the common CLI packaging failure mode without another runner.

This does not add a new daily or weekly tier. The existing Windows nightly remains in place.

Fixes #3259

Verification

• node --test --test-concurrency=1 scripts/ci-test-plan.test.mjs scripts/release-cli-workflow-policy.test.mjs (22 tests)
• npm run windows:inventory (3 tests; generated inventory current)
• actionlint .github/workflows/ci.yml .github/workflows/windows-baseline.yml .github/workflows/windows-recovery.yml .github/workflows/cli-package-validation.yml
• npm run format:check
• git diff --check
• npm --userconfig=/dev/null run release:cli:pack && npm --userconfig=/dev/null run release:cli:smoke (clean isolated build, offline installed-package validation passed)

Repository-wide tests and the Electron E2E suite were not run locally. The changed workflow will provide the selected CI evidence.

Discussion and rollout

The dev@maka.apache.org discussion remains open, and this PR is ready for concrete review. Do not merge while there are unresolved objections. If there are no objections after the stated 72-hour window, it can proceed under lazy consensus after human review of the final diff.

The stable required check remains CI / test. Live verification found no branch protection or repository ruleset that requires the removed platform job names.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex analyzed runner usage, implemented and validated the workflow changes, and performed independent deep reviews. Claude Opus performed separate adversarial reviews. I reviewed the final diff, the validation evidence, and each accepted or rejected finding.

Checklist

• Tests cover the planner and workflow contract
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes, described under Summary above
• No

[M4n5ter]

The consolidation itself looks sound, but there is one blocking integration issue before this leaves draft.

This PR removes the standalone typecheck job and makes test the sole stable core check, while #3262 currently configures branch protection to require both test and typecheck. The two PRs cannot land as written in either order:

• If chore: add .asf.yaml for ASF infrastructure self-service #3262 lands first, this PR cannot satisfy the required typecheck check.
• If this PR lands first, merging chore: add .asf.yaml for ASF infrastructure self-service #3262 will leave subsequent PRs waiting for a check that no workflow emits.

Please align #3262 with the final workflow—most simply, require only test and update its corresponding comments/body—then sequence the two merges accordingly.

I reviewed the consolidated test plan, Windows path filters, and CLI release path. I don’t see another issue that should block this PR. Removing the CLI validation main trigger is an intentional coverage tradeoff, while release staging still validates the exact candidate before publication.

[Astro-Han]

Thanks for catching this. #3262 has since been updated to require only test, and its body and commit message now explicitly record the merge order: #3261 first, then #3262. The current .asf.yaml no longer requires typecheck.

With that integration issue resolved and the checks green, I’m marking this PR ready for review.

Posted with Codex assistance.

[M4n5ter]

Re-reviewed the latest revision. The required-check mismatch is resolved, and I didn’t find any new issues on my side. LGTM.

[Astro-Han]

This change qualifies for the repository's self-merge fast path: it is limited to CI configuration, addresses an active repository-wide blocker, has passed the required check, and is straightforward to revert.

M4n5ter independently reviewed and approved the final revision. I have reviewed the final diff and commit message and am choosing the fast path as the human contributor of record. Any regression or subsequent community objection will be handled by reverting or adjusting the change.