ci: fast checks per PR, batch heavy builds to main/nightly/release - #6921

Why

Per-PR CI currently reruns the full multi-platform build suite on every push, so the Bugbot → fix → push loop is expensive. This moves expensive verification off the fast-feedback path and batches it into merge/nightly/release, keeping per-PR feedback quick.

Stacked on #6917 (the Depot→GitHub runner migration) since both touch the same workflows — base this on that branch; retarget to main once #6917 merges.

What changed

1. Cancel superseded runs — added concurrency: { group: <workflow>-<ref>, cancel-in-progress: true } to the CI workflows that lacked it (desktop_ci, mobile_ci, api_ci, web_ci, fmt, lint, zizmor, chrome_ci, bot_ci, db_ci, pro_api_e2e). Pushing 5 times now cancels the first 4 runs instead of running all 5.

2. desktop_ci — fast lane on PRs, heavy on main/nightly/dispatch:

• New js_ci (Linux): pnpm -F ui build + desktop typecheck + test (previously only ran inside the macOS job). Verified these pass on Linux.
• linux_ci: conditional matrix — x64 only on PRs, x64 + arm64 otherwise.
• macos_ci, windows_ci, desktop_swift: gated to github.event_name != 'pull_request'.
• Added a nightly schedule and js_ci to the ci aggregation gate.

3. mobile_ci — fast lane on PRs:

• New mobile_checks (Linux): pnpm -F @anlg/mobile typecheck + test.
• watchos_build, ios_build, android_build: gated off PRs → main/nightly/dispatch.

4. pro_api_e2e (hits live provider APIs): removed the pull_request trigger → runs on push:main + nightly + dispatch.

5. RELEASE_AUDIT.md — documents the model (per-PR fast lane / nightly on main / deliberate pre-release audit) and a checklist that ties into the existing qa-critical-ux, desktop_cd, desktop_linux_audio_qa, new-changelog, and release-new-version skills/workflows.

Result

• PRs run: lint, fmt, typecheck, unit/integration tests, Linux cargo check/cargo test (x64) — minutes, deduped.
• main + nightly run: full desktop matrix (macOS/Windows/Linux arm64/Swift) + mobile native builds. Nightly catches platform breakage within a day so the release audit stays a clean diff review.
• Release: full builds + real-hardware QA, done deliberately.

The required ci / mobile_ci aggregation gates still run on every PR and pass when heavy jobs are skipped (skipped ≠ failure).

Validation & caveats

• All workflows parse as valid YAML and pass dprint check.
• I can't execute GitHub Actions from here, so the trigger logic (skip-on-PR gates, conditional matrix, aggregation with skipped needs) should get one real run to confirm — open this PR (fast lane only should fire) and dispatch desktop_ci/mobile_ci once to confirm the full suite still runs on non-PR events.
• Draft-gating was intentionally left out: with the fast lane + cancel-in-progress, per-PR CI is already cheap, and the Bugbot loop happens on ready PRs (where draft-gating wouldn't apply). Easy to add later if you want zero CI on drafts.