ci: take release and smoke off the test path, publish only after every gate

[solace-aross]

What does this change do, and why?

Reshapes the ci.yml needs graph so a queue run no longer waits on test before it builds and smoke-tests the release, and so only a fully gated push run can publish anything.

• test no longer waits for fmt and clippy.
• release waits only for typos (and changes) and builds the two Linux musl binaries. smoke and smoke-oldest-client wait only for release. src stays in ci-gate and in publish's needs; nothing downloads its artifact, so release no longer waits for it.
• macOS moves to its own macos job: cargo check --bin nisshi --all-features --target aarch64-apple-darwin on pull requests, queue entries and pushes to main, and the full cargo auditable build --release plus tarball on v* tags only. macos stays in ci-gate. A nightly macos-release job in tier-c.yml (main only, no upload) builds the full macOS release so link and release-profile breaks show up before a tag; a red build opens the nightly-failure issue.
• No run pushes an image except publish. The package job is gone (it pushed on same-repo PRs and queue runs). smoke builds its image locally from release's binaries.
• publish runs on push to main and v* tags only, needs the same list as ci-gate (a red or skipped job anywhere stops it), pushes the multi-arch image (main on main; semver and latest on tags), and holds only packages: write. On main it pushes only while its commit is still the branch tip: each push run has its own concurrency group, so a slower run for an older commit could otherwise move the main image backwards. If the tip's own run fails, re-running it publishes.
• publish-release runs on tags only, needs publish, holds contents: write, and runs in the release environment, whose deployment policy allows v* tags only (no required reviewers). It uploads the tarballs. The upload moved out of release, so a failed leg can no longer publish a partial release. Neither job is in ci-gate's needs, because the "nothing skipped off pull_request" step would fail every queue run.
• The image is pushed before the release page, so a failed upload leaves an image without a release page until publish-release is re-run. Release-first would put a needs on a job that is skipped on main pushes, which would skip publish there.
• image-* artifacts keep 3 days on push runs (so a re-run of publish still finds them) and 1 day otherwise, about 134 MB per run.
• Cache: the compat jobs restore test's Rust cache (cache-shared-key: dev, never save), and tier-c.yml's test uses the same key. RUST_BACKTRACE and RUST_LOG moved from job env to step env, because rust-cache hashes RUST* variables into the key. build-storage and build-storage-lake keep cache: false, since cargo check reuses little of a full build.
• The same-repo Tier B condition and the compat matrix list are each written once as a YAML anchor, as Peter asked on ci: skip Tier B on fork pull requests #896.
• CLAUDE.md describes the new graph.

Expected effect (estimate, not verified until a real queue run): a queue run goes from about 45 min to about 18 min. The longest chain becomes release (13.7 min) then smoke (about 2.3 min), with test (14.5) and cargo-publish-dry-run (14.3) beside it. The macOS check took 8.4 min cold and 3.3 min warm on a throwaway branch; the full macOS build took 17.5 to 21.2 min.

How was this tested?

• actionlint and zizmor (the Workflow lint checks) pass.
• Tier B jobs are skipped on this PR while the merge queue is on, so the first queue run is the first run of the new release, macos and local-image smoke legs.
• publish, publish-release, the multi-arch push and the release upload have not run. The first main push and the first tag will be their first runs.
• Compat cache hit rate is unmeasured; compare the first queue runs with their earlier durations (about 12 min each). The dev key is cold until the first push to main saves it.

Notes: queue settings are untouched. Anything queued that edits smoke, package or the needs lines will need a rebase. release.yml (crates.io, on any v* tag, no needs on CI) is unchanged and still not gated by this workflow.

Checklist

• Commits are signed off (git commit -s) — see CONTRIBUTING.md
• just fmt, just clippy, and just test pass locally (not applicable, workflow and docs only)
• Tests added or updated for the behavior changed (not applicable, workflow only)
• Docs updated if user-facing behavior changed

🤖 Generated with Claude Code

[solace-aross]

@reubenjds thank you for the careful review. All five points are in (head 6a13e36), and each thread has a reply.

One note on CI: the test and compat jobs on this branch failed on Docker Hub toomanyrequests when pulling the postgres image, not on the change. I will re-run them once the limit clears.

I will leave this open for a few more sets of eyes.

[solace-aross]

Rebased on main and added one commit (702ed9b). publish now pushes the main image only while its commit is still main's tip. Each push run has its own concurrency group, and publish waits for all of Tier B, so a slower run for an older commit could otherwise overwrite :main with an older image. Tags are unchanged. The PR body now follows the template.