Verify affected PR checks once and separate CI policy from execution

[SaladDay]

Daily CI currently repeats checks after merging to main, and unclassified inputs silently start the entire gate. Make the PR the daily verification boundary: cancel obsolete runs, select affected checks once, and require the selected group to be rerun together after a failure. Releases explicitly request full verification at an immutable source SHA.

Separate pure selection policy and prerequisites from Git/event planning and result validation. Reusable group workflows own execution commands; the central workflow only plans, calls and verifies. Their existing commands, browser isolation and native platform coverage are preserved. Workflow edits select the group they own; policy/orchestration changes run their contract tests and lint. Unknown inputs or an unverified diff stop planning instead of running everything or passing unchecked.

The plan records its Actions attempt; the required gate rejects partial reruns that reuse an earlier plan. Native release-check retries replace their existing named artifacts, while publication recovery still reuses the successful build artifact. Main pushes no longer start the daily workflow.

Validation: 33 CI policy/gate/workflow tests, 15 naming tests, 19 documentation tests, actionlint, command-body equivalence for all six extracted workflows, CLI plan/gate integration and replay of 18 historical PR diffs. Independent blind review found no actionable in-scope issue. Actual Actions probe #325 passed with hygiene only; a single-job retry failed the attempt guard as intended, and Re-run all jobs passed with hygiene only again (run 36754177441, attempts 1–3). Updating this PR to main #323 cancelled the obsolete run 36754122404. The previous run 36754569672 exposed a pre-existing test ownership-handoff race. Backend fix #326 is now merged; this branch includes main 3870bae (#326 and #327) at head 3a99bff. The complete CI diff is unchanged from independent review, the 33/19/15 focused tests passed again, and final Actions run 36759281196 passed all 14 executed jobs, including backend, both browser shards, Linux/macOS/Windows native checks and the required gate. API and image acceptance were correctly omitted by the plan. No business code, production timeout, branch protection or release publication change is included.