Summary

• Shrinks the daily ci.yml workflow to Linux-only and keeps release work in build.yml.
• Splits the old matrix gate into typecheck and unit, then adds a stable aggregate check job for future branch protection.
• Adds Bun + Turbo cache, uploads JUnit XML artifacts, and only publishes JUnit checks for push / same-repo PRs.
• Replaces trigger-level path skipping with a conservative docs-only classifier that always starts the workflow and handles rename / copy cases safely.

Why

The old CI mixed stable checks with a flaky Windows lane in one blocking workflow, so red runs were hard to trust. This version keeps the daily gate narrow and stable, while avoiding the required-check, docs-only, fork-permission, and rename holes caught during review.

Test plan

• Local YAML parse: ruby -e "require 'yaml'; YAML.load_file('.github/workflows/ci.yml')"
• git diff --check
• Fresh-eyes review on the final workflow, no remaining blocker
• First real GitHub Actions run on this PR is green