ci: consolidate and accelerate checks

[galjos]

Changes

• replace six pull-request workflows with one cancellable PR Gate
• keep Preflight and Required result present on every pull request; filter heavy jobs inside the workflow
• keep x86 Release/integration, x86 Debug/coverage, ARM Release, static-LTO smoke, and deterministic performance checks in the pull-request gate
• move full lint, full static-LTO/tests, ARM Debug/integration, MPI, benchmark smoke, and Singularity to Extended CI
• lint changed production C++ files; lint the full production tree when .clang-tidy or the lint driver changes
• pin the integration dependency input used by the Conda cache
• incorporate the path-filter hardening from refactor: move path filtering logic from on to steps #495 without restoring legacy workflows

Closes #491.

Result

At workflow commit 6823c964, the pull-request critical path is 1.56x faster than dev.

• dev baseline
• pull-request run

The pull-request run used warm caches. The dev critical-path LTO job did not use compiler caching, so this is an end-to-end workflow comparison, not a compiler-only benchmark.

Coverage

• retain the existing Codecov v3 XML and GCOV uploads
• keep Codecov project and patch checks enforced
• allow 0.01 percentage points of project-level rounding noise from compiler-generated coverage points; patch coverage remains enforced

Constraints

• keep CTest serial because several tests share files; compilation remains parallel
• compare performance against the exact pull-request base SHA
• grant write access only to the performance job that updates its cache
• cancel superseded pull-request runs

Validation

• actionlint 1.7.12
• workflow YAML parsing
• script unit tests
• changelog fragment validation
• shell syntax validation
• synthetic path-filter checks for lint and license tooling
• local static-LTO build and executable smoke test

After merge

• require PR Gate / Required result on dev and main
• verify the first Extended CI run on dev

[pq-perf-bot]

⚡ Performance (instruction count) — ✅ no regressions

per-benchmark breakdown

benchmark	base Ir	PR Ir	Δ
bondedForces	38.24M	38.24M	+0.00%	✅
boxTransforms	10.67M	10.67M	+0.00%	✅
constraints	10.91M	10.91M	+0.00%	✅
coulombKernel	5.80M	5.80M	+0.00%	✅
forceKernel	14.16M	14.16M	-0.00%	✅
integrator	32.44M	32.44M	+0.00%	✅
interWater	1681.40M	1681.40M	+0.00%	✅
kinetics	8.55M	8.55M	+0.00%	✅
linearAlgebra	2.08M	2.08M	+0.00%	✅
nonCoulombPairs	5.48M	5.48M	+0.00%	✅
shiftVector	5.81M	5.81M	+0.00%	✅
virial	10.44M	10.44M	+0.00%	✅

_{Deterministic callgrind instruction counts vs the base branch; gated at ±2%. Not wall-clock.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.02%. Comparing base (7358b79) to head (4c4df9e).

Additional details and impacted files

@@           Coverage Diff           @@
##              dev     #489   +/-   ##
=======================================
  Coverage   91.02%   91.02%           
=======================================
  Files         320      320           
  Lines       14565    14565           
  Branches     4825     4825           
=======================================
  Hits        13258    13258           
  Misses       1221     1221           
  Partials       86       86           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Approval dismissed: new commits contain changes beyond a merge-up from dev.

Approval dismissed: new commits contain changes beyond a merge-up from dev.

Approval dismissed: new commits contain changes beyond a merge-up from dev.