refactor(ci): gate long-running checks to promotion PRs + push to main [skip-regression-check]

Skip Docker Build, WASM WIT, Windows Build, Telegram tests, and
version-check on developer PRs (branch→staging). These only run on
promotion PRs (staging→main, labeled staging-promotion) and push
to main.

Developer PRs only run unit tests for fast feedback. Full integration
suite runs at promotion time as the quality gate.

Roll-up job updated to accept skipped as passing for gated jobs.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

.github/workflows/test.yml

@@ -38,6 +38,9 @@ jobs:
 
   telegram-tests:
     name: Telegram Channel Tests
+    if: >
+      github.event_name == 'push' ||
+      contains(github.event.pull_request.labels.*.name, 'staging-promotion')
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -50,6 +53,9 @@ jobs:
 
   windows-build:
     name: Windows Build (${{ matrix.name }})
+    if: >
+      github.event_name == 'push' ||
+      contains(github.event.pull_request.labels.*.name, 'staging-promotion')
     runs-on: windows-latest
     strategy:
       fail-fast: false
@@ -74,6 +80,9 @@ jobs:
 
   wasm-wit-compat:
     name: WASM WIT Compatibility
+    if: >
+      github.event_name == 'push' ||
+      contains(github.event.pull_request.labels.*.name, 'staging-promotion')
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -94,6 +103,9 @@ jobs:
 
   docker-build:
     name: Docker Build
+    if: >
+      github.event_name == 'push' ||
+      contains(github.event.pull_request.labels.*.name, 'staging-promotion')
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -104,7 +116,9 @@ jobs:
   version-check:
     name: Version Bump Check
     runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
+    if: >
+      github.event_name == 'pull_request' &&
+      contains(github.event.pull_request.labels.*.name, 'staging-promotion')
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -123,12 +137,23 @@ jobs:
     needs: [tests, telegram-tests, wasm-wit-compat, docker-build, windows-build, version-check]
     steps:
       - run: |
-          if [[ "${{ needs.tests.result }}" != "success" || "${{ needs.telegram-tests.result }}" != "success" || "${{ needs.wasm-wit-compat.result }}" != "success" || "${{ needs.docker-build.result }}" != "success" || "${{ needs.windows-build.result }}" != "success" ]]; then
-            echo "One or more jobs failed"
-            exit 1
-          fi
-          # version-check only runs on PRs, so skip/success are both acceptable
-          if [[ "${{ needs.version-check.result }}" == "failure" ]]; then
-            echo "Version bump check failed"
+          # Unit tests must always pass
+          if [[ "${{ needs.tests.result }}" != "success" ]]; then
+            echo "Unit tests failed"
             exit 1
           fi
+          # Gated jobs: must pass on promotion PRs / push, skipped on developer PRs
+          for job in telegram-tests wasm-wit-compat docker-build windows-build version-check; do
+            result="${{ needs.telegram-tests.result }}"
+            case "$job" in
+              telegram-tests) result="${{ needs.telegram-tests.result }}" ;;
+              wasm-wit-compat) result="${{ needs.wasm-wit-compat.result }}" ;;
+              docker-build) result="${{ needs.docker-build.result }}" ;;
+              windows-build) result="${{ needs.windows-build.result }}" ;;
+              version-check) result="${{ needs.version-check.result }}" ;;
+            esac
+            if [[ "$result" == "failure" || "$result" == "cancelled" ]]; then
+              echo "$job failed"
+              exit 1
+            fi
+          done