[TheGreatAxios]

Summary

Pull requests now run changes, lint, typecheck, policy and the unit and postgres tests. The chain shards and the dom tests still report on a pull request so their required checks pass, but their steps run only in the merge queue. Push behaviour is unchanged.

• skills/** is now in the shared filter, because a contracts test reads the setup skill's reference.
• In the merge queue, the hub and sidecar images are built without pushing when Dockerfile, apps/*/Dockerfile*, bun.lock or .github/workflows/** change. This reuses image.yml, which pushes only on a push to main.
• The unused platform filter is removed.

Verification

• bunx --bun yaml-lint .github/workflows/ci.yml and bun run lint pass.
• This pull request's own checks show the chain shards and test (dom) succeeding with their steps skipped.

Refs CL-12132

[linear-code]

CL-12132

[corbits-triage]

Triage: Pass

No changes needed from you. A maintainer will review this pull request.

Notes:

• changes sensitive paths: ci: .github/workflows/ci.yml
• Risk: medium (ci paths)

[corbits-triage]

No defects reported.

[TheGreatAxios]

Closing: #838 already runs chain and dom only when a PR touches what they cover, so they keep catching bugs before merge. Running them only in the merge queue would move those catches to merge time.