#13629 CI: stop unnecessary Release builds and gate paid runner

What changed

• Treat Resources/bin/open and tests/test_open_wrapper.py as Release-build-neutral CI inputs.
  • They still route through macOS validation.
  • They stop queueing the universal xcodebuild -configuration Release lane.
• Add a cheap Linux release-admission job in the reusable macOS workflow.
  • It waits for the existing top-level linux-preflight verdict.
  • The paid macOS 26 Release runner now requires that admission to pass.
  • A red guard/web/preflight result blocks the Release runner before allocation.
• Add regression coverage for both the path routing and the Release admission dependency.

Why

Run https://github.com/manaflow-ai/cmux/actions/runs/35689908387 exposed both problems:

1. PR #13301 only changes the open wrapper plus its regression test, yet CI routed it into macos / release-build.
2. The guard gate had already failed before the paid Release job started, so CI continued spending macOS build time on a run that was already red.

This keeps the existing macOS compile/test concurrency while preventing the universal Release build from starting unless the cheap routed CI verdict is green.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Stops CI from queueing product work that can't catch anything new: open wrapper-only changes skip the universal Release build, the paid macOS Release runner is gated on a green Linux preflight, and routing-policy-only PRs run no product-area CI.

Release builds

• Resources/bin/open and tests/test_open_wrapper.py changes still route through macOS validation but no longer queue the universal xcodebuild -Configuration Release lane.
• A Linux release-admission job waits for linux-preflight and blocks the paid macOS 26 Release runner when the guard/web/preflight result is red.

Queued work

• Mixed PRs that touch routing policy classify product inputs with the trusted base router; policy-only PRs skip product CI entirely, including top-level ci.yml edits that only change macOS jobs.
• Reusable workflow edits run only workflow-guard-tests; ci-macos.yml edits that only change Release jobs run just the release-related guard groups, and web-complexity workflow edits run only the ci group.
• macOS-only changes no longer queue the web workflow; the native diff-sidecar inputs it validates are routed there explicitly.
• The changes job skips macOS compile admission when the app-host build-input fingerprint matches HEAD^1.
• web-complexity only queues for web/** paths, and web-complexity-trusted scopes pull requests from the GitHub file list before web setup, so it no longer retriggers on PR metadata edits or ready-state flips.
• Adds regression coverage for all of the above.

Summary by CodeRabbit

• Bug Fixes

  • Release builds now require successful Linux preflight validation.
  • Unnecessary release builds are skipped for macOS-only open-wrapper changes while focused tests continue to run.
  • CI routing now skips unrelated product checks and reuses unchanged build-input validation where possible.
  • Web complexity checks run only for relevant web changes.
  • macOS status reporting includes release admission results.

• Tests

  • Expanded coverage for release gating, CI routing, workflow scope detection, and change classification.