ci: skip duplicate desktop artifact matrices

[abrichr]

What changed

• Add a fail-safe changed-files classifier before the expensive artifact jobs.
• Keep the representative Linux frozen-sidecar build on pull requests.
• Keep the complete sidecar and installer matrices for explicit release-candidate dispatches.
• Keep the complete matrices for dependency, toolchain, packaging, native-runtime, license, and notice changes on main.
• Skip duplicate sidecar and installer matrices for application-only merges after their pull-request and exact-main tests pass.
• Add focused classifier tests and fail toward the complete matrix for unknown or empty change sets.

The immutable desktop-v* release workflow remains unchanged. It always rebuilds, installs, launches, uninstalls, hashes, attests, and stages every supported installer.

Why

The main build after PR #88 repeated three frozen-sidecar jobs and four installer jobs for Python and React application changes. A comparable completed run used about 50.5 runner-minutes for those seven jobs. The pull request already built the representative Linux sidecar. The exact-main test workflow still covers Python on Linux, macOS, and Windows. The release tag still performs the complete release build.

The first merge of this classifier intentionally runs the complete matrix because the classifier and build workflow are artifact-sensitive inputs. Later application-only merges should save about 50 runner-minutes each.

Checks

• pytest tests/test_build_change_classifier.py -q (18 passed)
• ruff check scripts/classify_build_changes.py tests/test_build_change_classifier.py
• ruff format --check scripts/classify_build_changes.py tests/test_build_change_classifier.py
• actionlint .github/workflows/build.yml
• git diff --check
• Exact PR feat: compile recordings automatically after stop #88 path set classifies as application-only.

This PR stays in draft while the active Desktop authentication and phone-decision work settles.