CI: defer macOS Debug from pull requests (D3, CR-195) - #454

This change stacks on 14c3365
(14c3365).

Use an expression-driven matrix exclude to remove exactly macos-26 + Debug
on pull_request. Ubuntu Release/Debug and macOS Release keep their existing
build names. Every non-PR event retains the complete matrix, including push,
workflow_dispatch, schedule and release contexts; existing triggers and the
separate release workflow stay unchanged.

The aggregate continues to require the selected matrix's result, with no
missing-leg exception. Pin its whole result step as well as the exact build
strategy, and add must-fail mutations for lost PR or full-event coverage and
for accepting absent or skipped matrix results. Preserve the classified
documentation-only skip.

Update the event table, PR policy, docs-only counts, runner description and
historical timing context. Keep the PR's own macOS Release proof and Release
registration floor. Preserve the existing pinned AGENTS.md citation in place.

The following parent documentation sentences are intentionally rewritten.
Each quotation reproduces the old sentence in full, including its consecutive
words, so this commit's own message names the changes for doc-reverts:

docs/ci.md:

- "A PR that changes more than documentation runs preflight and the parity subset with its full set; both Release jobs, both Debug jobs, kernel-only, sanitizers and the native cell of native-live run the registered set excluding the 29 CTest rows labelled `slow` in `tests/CMakeLists.txt` ([PR tier versus MAIN/RELEASE](#pr-tier-versus-mainrelease-what-is-excluded-where))."
- "A pull request or a push to `main` whose change is documentation only runs `preflight` and the documentation build and skips every proof job: the four `build` legs, both macOS legs among them, `sanitizers`, `kernel-only`, `native-live` and `corpus-parity-subset`."
- "A skipped matrix is never expanded, so a documentation-only run shows one skipped `build` check under its unexpanded name instead of the four legs."
- "The `build` matrix retains its four legs and their `build (<image>, <type>)` names."
- "The two hosted macOS legs stay on `macos-26` (M1, 3 cores, 7 GB)."
- "A Release leg runs its full population on push and dispatch events; a pull request's Release legs, a fork's included, exclude the `slow` rows like its Debug legs, and that pull-request time is to be measured on real PR runs."

AGENTS.md:

- "GitHub Actions is advisory: PR Release, Debug, kernel-only, sanitizers and native jobs exclude the measured `slow` CTest rows; push-to-main and manual CI dispatch run every row, and a documentation-only change runs preflight alone."

CONTRIBUTING.md:

- "The GitHub Actions jobs (build on Ubuntu + macOS in Release and Debug, sanitizers, ctest, the source guards, the install/`find_package` smoke test and the parity subset) are advisory."

Verification: NOT RUN. This lane is restricted to file edits and permitted
read-only inspection; no repository code, parser, linter, test, build or corpus
verification was run. Lab preflight tests, doc-anchors and doc-reverts, the
PR's own GitHub CI and the required Claude Opus read remain pending.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

D3 (macOS Debug leaves the pull-request matrix) was written on the pre-merge D1
squash 14c3365; main's final D1 is textually identical to it in the four files
that conflicted (AGENTS.md, docs/ci.md, scripts/ci_preflight.py,
scripts/test_ci_preflight.py: git diff 14c3365 0212cab is empty for them),
so each conflict resolves to the D3 side. No D1 text is dropped; D3's own
rewritten sentences are named in the D3 commit message.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Both intents kept: D3 (macOS Debug excluded from pull-request builds, its
ci.yml matrix exclude and docs/ci.md build row) and #462 (no timeout-minutes
anywhere; scripts/ci_preflight.py requires their absence). The single
conflict, docs/ci.md's preflight row, takes main's wording (owner #827
removed every declared job timeout; GitHub's 6 h platform maximum); the
build row keeps the D3 text.

Co-Authored-By: Claude Code <[email protected]>

Brings in #461 (engine release jobs on pf-ci-release). It touches
.github/workflows/promote-baseline.yml, .github/workflows/release.yml,
.github/actionlint.yaml, docs/ci.md, scripts/ci_preflight.py and
scripts/test_ci_preflight.py; the merge has no conflict (this branch changes
ci.yml, AGENTS.md, CONTRIBUTING.md and different regions of the other three).
No resolution edits were made.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>