ci: reduce duplicate work and isolate integration checks

[jacksteamdev]

Regular CI now runs once per PR update and on main pushes, with independent native, preparation-tooling and Worker jobs. PR changes select affected jobs conservatively; main/manual runs select all jobs. The final verify status rejects failures, cancellations, unexpected skips and malformed selection outputs.

Pinned tools are cached independently from application source. Worker helper archives have recorded SHA-256 checksums, version validation and bounded transient-download retries. Supported binary overrides remove implicit helper downloads during compilation. Rust dependency compilation and Bun/pip package downloads are cached; final application/distribution outputs are rebuilt.

This PR depends on #1 and is stacked on its MPL/notices branch. Runtime calculations, fixture contents, dependency versions and the full-data workflow are unchanged.

Validation:

• 11 CI-helper tests, strict TypeScript, actionlint, notice freshness and diff checks pass.
• Independent standards and spec reviews have no remaining findings.
• The first cold run exercised helper downloads, checksums, version checks and installation. It exposed a previously implicit native-job requirement to fetch Wasm dependencies before the offline boundary check; this is fixed in 400ec0d.
• All jobs pass on the final commit: https://github.com/jacksteamdev/astrology-engine/actions/runs/37158635483 . Tool and Rust dependency cache hits are confirmed; Worker logs confirm WASM_BINDGEN_BIN, WASM_OPT_BIN and ESBUILD_BIN use.
• Prose-only PR test: prose-only CI selection (do not merge) #3 passed with changes, usage-policy and verify running and all expensive jobs skipped: https://github.com/jacksteamdev/astrology-engine/actions/runs/37158444823 . The temporary PR is closed without merging and its remote branch/worktree removed.
• Each branch update triggered only one PR workflow, with no duplicate push run. Main/manual all-job selection, rename/deletion handling, fallback selection, retry exhaustion, checksum/version rejection and aggregate failure behavior are tested.

Observed timings (individual runs, not a performance guarantee):

Measurement	Time
Previous complete workflow	4m 24s
New complete workflow with restored caches	1m 28s
New Worker job with restored caches	37s
Worker tool setup, cold / warm	2m 18s / 3s
Prose-only workflow	20s

Native dependency compilation was still cold in the successful final run because its earlier failed job did not save its compilation cache. Cold caches remain functional and slower; no checks were weakened to meet the warm-run target.