CI: run checks on stacked flux-pumping PRs and base retargets

[krystophny]

Problem

Both PR workflows filter pull_request events to bases main/master, so
every PR in the stacked flux-pumping chain (bases like
fix/flux-pumping/*, diag/flux-pumping/*, integration/flux-pumping/*
— currently #154, #157–#159, #161–#165) runs zero checks: empty
statusCheckRollup, and a CLEAN merge state that is vacuous. In addition:

• test-on-pr.yml has no workflow_dispatch, so the golden-record suite
  cannot be run on a stacked head at all (only unit-tests.yml is
  dispatchable today).
• Retargeting a PR base fires only the edited event, which is absent
  from types in both workflows, so a PR retargeted onto main still
  gets no CI until its next push.

Change

Design constraint (this is why the event handling lives in a separate
workflow): run-golden-record is the sole required status check on
main (ruleset 7026456, strict, zero required reviews). A job skipped
by its if reports Success, and the newest same-named check run on the
head SHA is what the merge gate evaluates — so the required workflow
must never see an event it would respond to with a skipped job.

test-on-pr.yml:

• pull_request types and branches stay byte-identical to main;
  every check run named run-golden-record comes from a real run.
• Add workflow_dispatch with a compare_against_main input
  (default true) so the golden-record suite can be run on any head,
  including stacked ones; the four main-comparison steps run for
  pull_request or dispatch-with-comparison. Dispatch concurrency is
  keyed by run_id, matching unit-tests.yml (cf. ci: key workflow_dispatch concurrency by run, not workflow name #110).

unit-tests.yml:

• Add base-branch patterns fix/flux-pumping/**, diag/flux-pumping/**,
  feat/flux-pumping/**, integration/flux-pumping/** to the
  pull_request filter. Unit tests are cheap enough to run on every
  stacked push, and these are always real runs — no skip condition
  beyond the pre-existing draft guard.

stacked-pr-dispatch.yml (new):

• Reacts to the events the real workflows must not see: labeled
  (filtered to the run-golden-record label), edited with a base
  change (retargets), and pushes to stacked PRs that carry the label.
• Its job is named dispatch-stacked-checks, so its skipped runs can
  never shadow run-golden-record or unit-tests.
• It re-triggers the real workflows via gh workflow run (the
  GITHUB_TOKEN exception for workflow_dispatch applies; the job has
  actions: write). Retargets dispatch unit tests always and golden
  record when the new base is main/master or the PR carries the
  label; label events and pushes to labeled stacked PRs dispatch golden
  record. Fork heads are excluded (dispatch only targets in-repo refs).
• Golden-record cost stays label-gated for stacked bases: the suite
  builds NEO-2 three times and runs lorentz/ql/par/performance —
  roughly an hour of runner time per push, which would multiply across
  a 10-PR chain rebased in bulk if run unconditionally.

Known limitation: workflow_dispatch uses the workflow definition on
the target ref, so dispatching test-on-pr.yml on a stacked head works
only once that head contains this change (rebase the stack onto an
updated main first). unit-tests.yml has been dispatchable since #110
and works on current heads today.

No job content, tolerances, or build steps change; only triggers,
concurrency, and run conditions.

Verification

• gh api repos/itpplasma/NEO-2/rules/branches/main confirms
  run-golden-record is the only required status check (strict policy,
  required_approving_review_count: 0).
• actionlint 1.7.12 on all three files: identical finding set (21)
  before and after — all pre-existing SC2086 notes in untouched run
  scripts plus the pre-existing github.head_ref note; zero findings in
  the new workflow.
• yaml.safe_load parses all three files; pull_request.types of the
  two check workflows verified identical to main
  ([opened, synchronize, reopened, ready_for_review]).
• Job names verified unique across .github/workflows/.
• Dispatchability confirmed live earlier for unit-tests.yml on the
  heads of Align pitch crossings to the nearest grid point #164 and Preserve geometry at pitch crossings #165.

[krystophny]

Dispatched unit-test runs on the current stacked heads (their copies of unit-tests.yml already carry workflow_dispatch, so this works before this PR merges):

• Align pitch crossings to the nearest grid point #164 head fix/flux-pumping/align-pitch-crossings @ f9b0062: https://github.com/itpplasma/NEO-2/actions/runs/29505209904
• Preserve geometry at pitch crossings #165 head fix/flux-pumping/preserve-crossing-geometry @ 0345e33: https://github.com/itpplasma/NEO-2/actions/runs/29505211940

Golden-record cannot be dispatched on those heads yet: workflow_dispatch uses the workflow file at the given ref, and their copies of test-on-pr.yml lack the trigger. That becomes possible once this change reaches the stacked branches (rebase of the chain, or the run-golden-record label after merge).

[krystophny]

Review found a blocking defect in d07b711 and ca354de fixes it.

Defect: run-golden-record is the sole required status check on main (ruleset 7026456, strict, zero required reviews — verified via gh api repos/itpplasma/NEO-2/rules/branches/main). Adding edited/labeled to the required workflow's pull_request.types with a job-level skip guard meant a plain title/body edit or any unrelated label addition on a main-based PR spawned a run whose job skipped — and a conditionally skipped job reports Success and satisfies the required check as the newest same-named check run on the head SHA. Worse, the PR-number-keyed cancel-in-progress group let such an event cancel a real in-flight golden-record run and replace it with skipped=Success. Net effect: a red golden record could be laundered into a mergeable PR with zero reviews.

Fix (ca354de):

• test-on-pr.yml: pull_request types/branches restored byte-identical to main — every run-golden-record check run is now a real run. workflow_dispatch (with compare_against_main) is kept.
• unit-tests.yml: edited dropped from types and the job condition reverted, so title edits no longer overwrite the latest real unit-tests result with skipped (same laundering shape, just not merge-gating). The stacked base patterns stay — those runs are always real.
• New stacked-pr-dispatch.yml: handles labeled (run-golden-record label), base retargets (edited + changes.base), and pushes to labeled stacked PRs, under a differently named job (dispatch-stacked-checks) that re-triggers the real workflows via gh workflow run. No check run named run-golden-record or unit-tests can ever be created in a skipped state, and unlabeled stacked PRs no longer accumulate skipped golden-record check runs on every push.

Known limitation (inherent to workflow_dispatch): dispatching test-on-pr.yml on a stacked head works only once that head contains this change, i.e. after the stack rebases onto an updated main. feat/flux-pumping/** is kept as deliberate future-proofing — several feat/flux-pumping/* branches exist as stack heads and may become bases; the pattern is inert until then.

Verification: actionlint 1.7.12 reports the identical 21 pre-existing findings before/after and zero in the new file; yaml.safe_load parses all three; job names verified unique across .github/workflows/. PR body updated to describe the corrected design.