* ci: add full build and quality checks on push to main
Adds a new main-build.yml workflow that runs the full 7-platform build
matrix on every push to main, uploading artifacts for 30 days. Also
adds push-to-main triggers to code-quality, test, and nix-check
workflows. The nix full build now always runs on main pushes (not just
when nix packaging files change), catching the expensive breakage that
currently requires manual verification before each release.
* ci: fix permissions and clarify nix full-build intent
- narrow contents: write to contents: read in main-build.yml — no
release assets are uploaded here so write access is unnecessary
- update nix-check comment to reflect that the full build always runs
on push to main (not just when nix files change), matching intent
* ci: reduce PR check time from ~30 min to ~1 min
- merge lint + prettier into single code-quality workflow
- add concurrency groups to cancel stale runs on rapid pushes
- add path filters so irrelevant changes skip checks
- make full nix build opt-in via "nix" label (eval-only by default)
- add nix store caching via magic-nix-cache-action
- cache trusted-signing-cli binary on windows builds
- upgrade setup-bun from v1 to v2
* ci: add workflow path filters and expand nix build triggers
- add .github/workflows/** to path filters on code-quality and nix-check
so CI runs when workflow files themselves change
- include tauri.conf.json and build.rs in nix full-build diff check since
these can break nix sandbox builds independently of cargo builds
