ci: explicit-trigger heavy workflows (auto on PR open, manual after)

[borisbat]

What

The heavy CI workflows — build, extended_checks, wasm_build — now auto-run only when a PR opens (pull_request: types: [opened, reopened, ready_for_review]), not on every subsequent push (dropped the implicit synchronize). Re-run them on demand:

• Actions → workflow → Run workflow on your PR branch, or
• gh workflow run build.yml --ref <branch> (also extended_checks.yml, wasm_build.yml).

doc/codeql stay paths-gated; msvc is already workflow_dispatch-only; the post-merge push: [master] run still validates master after each merge.

Why

Cost control. Copilot review is a ruleset check, not a runner job — it re-runs free on every push. So the iteration loop becomes: push → free Copilot read → fix → repeat (zero runner minutes), then deliberately fire the matrix once on the final commit instead of on every intermediate push. During the recent spending-limit incident, a single PR's Copilot rounds would otherwise have burned ~5 full matrices; this makes it 1.

Green is per-SHA, so a passing run vouches only for the commit it ran on — push a new commit and the heavy checks are absent on the new HEAD until you re-dispatch. That gives "green only on the latest commit" for free (no required-status-checks needed). master is not hard-gated on these checks (maintainer discipline) — the discipline is: dispatch on your final commit, merge only on its green.

Follow-up (not in this PR)

A /ci PR-comment dispatcher (ChatOps) would be more ergonomic than the Actions button, but the default GITHUB_TOKEN can't fire workflow_dispatch (GitHub recursion-prevention), so it needs a stored CI_DISPATCH_TOKEN PAT (scope: actions:write). Deferred until that secret exists.

Docs

• CLAUDE.md → GitHub Operations → new "CI runs on EXPLICIT trigger" section
• skills/make_pr.md → new step 7 ("trigger the heavy CI on your final commit before merge") + quick-ref row
• skills/pr_review_iteration.md → explicit-trigger callout + corrected "CI re-runs on push" (now Copilot-only)
• skills/preflight.md → "What runs on a PR" table updated

Self-validating

This PR's own CI exercises the new triggers — the matrix should auto-run once now (on opened); after that, pushes won't re-trigger it and I'll dispatch manually. If you see the build matrix run here, the change works.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates CI triggering to reduce runner spend by making the heavy workflows run automatically only on PR open/reopen/ready-for-review (and still on push: master), with manual workflow_dispatch re-runs for subsequent commits; accompanying contributor docs are updated to reflect the explicit-trigger iteration loop.

Changes:

• Adjust build, extended_checks, and wasm_build workflows to use pull_request: types: [opened, reopened, ready_for_review] (dropping the implicit synchronize behavior).
• Document the explicit-trigger model and the “dispatch heavy CI on final SHA” discipline across contributor skills and CLAUDE.md.
• Update the PR “what runs” table to reflect the new triggering model and include msvc.yml.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
skills/preflight.md	Updates PR CI trigger table and adds explicit-trigger explanation.
skills/pr_review_iteration.md	Adds explicit-trigger CI guidance to the iteration loop.
skills/make_pr.md	Adds a new step to manually dispatch heavy CI on the final commit.
CLAUDE.md	Documents the explicit-trigger CI policy in the main contributor guide.
.github/workflows/build.yml	Limits PR auto-runs to PR open/reopen/ready + keeps dispatch.
.github/workflows/extended_checks.yml	Limits PR auto-runs to PR open/reopen/ready + keeps dispatch.
.github/workflows/wasm_build.yml	Limits PR auto-runs to PR open/reopen/ready + keeps dispatch.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

[borisbat]

Closing: the free-runner switch (#3233) already solved the cost problem (public-repo standard runners are free/unlimited), so explicit-trigger has no upside. Worse, workflow_dispatch runs are not PR-associated, so the PR badge shows green regardless of the real dispatch state = no honest merge gate. Reverting to the simple model already on master: auto-run on every push (gated + free). Remaining trim (mingw/clangcl to nightly) lands as a separate PR.