ci: validate each change once instead of three times

[tignear]

Summary

Two weeks of ci.yml (2026-09-23 to 2026-10-07: 709 completed runs, ~45,000
job-minutes) showed that change-based job selection rarely skips anything:
Rust Tests ran in 92% of pull request runs and the Windows/JS jobs in 96%. The
real cost is that each change is validated three times:

Event	Job-minutes	Share
pull_request	20,001	44%
merge_group	15,201	34%
push (master/develop)	9,746	22%

This PR validates each change once where it matters:

• No push runs. The merge queue validates the exact tree that lands on
  master/develop, so the push run repeats it (~9,700 job-minutes). Nothing
  consumes those runs. Daily full runs (scheduled on master, dispatched on
  develop) save the branch-scoped Rust caches that pull requests restore.
• Windows and ARM64 jobs leave pull requests. NAPI Build (Windows), JS Test (Windows), NAPI Build (Linux ARM64 GNU) and ARM64 Backend Test run in
  merge groups and full runs only (~4,500 job-minutes on ordinary PRs). Only 1
  of 336 PR runs failed on these jobs while the Linux jobs passed (an ARM64
  backend failure). Their skipped runs satisfy the required checks, so the
  rulesets are unchanged. Dispatching ci.yml on a branch still runs them.
• Daily develop synchronization. sync-develop.yml updated the
  master-to-develop PR on every master push, re-running its CI each time (60
  runs, ~4,200 job-minutes). It now runs daily at 22:07 UTC, before the develop
  full CI at 02:43 UTC, and on dispatch. The retry after a preserved (hand
  resolved) sync lands is now the next daily run.

Together with #1105 (the release PR stops re-running everything, ~3,600
job-minutes), this removes roughly 40–45% of CI job-minutes.

Validation

• node --test scripts/*.test.mjs: 118 pass. New tests assert that ci.yml has
  no push trigger, that exactly the four platform jobs skip pull requests while
  the Linux jobs do not, and that the sync workflow runs daily without push or
  pull_request_target triggers (replacing the old trigger test).
• actionlint on ci.yml and sync-develop.yml: no new findings (only the
  existing ubuntu-26.04-arm runner label warning).
• The savings figures come from the GitHub Actions job timings for every run in
  the period above.
• Not run on Actions yet: the first PR without platform jobs (this PR itself),
  the merge group running them, and the first daily sync.
• Trade-off: a Windows/ARM64-only failure now surfaces in the merge queue and
  ejects the PR there, instead of on the PR.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T17:17:49.145070Z	186ddcc	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codspeed]

Merging this PR will not alter performance

✅ 4 untouched benchmarks

---

_{Comparing ci/reduce-duplicate-runs (186ddcc) with master (d353dae)}