fix(ci): a PR cannot trigger a full workspace run any more

[Sunrisepeak]

What changes

full (the escalation to MEMBERS=__ALL__) now answers only on schedule and workflow_dispatch. On a pull_request or a push, the same reasons call a new widen which records them, prints them, and writes them to the run summary.

reason	before	after (PR / push)
.github/workflows/validate.yml, tests/*.sh	full run	note + select nothing extra
mcpp.toml non-member change	full run	note + select nothing extra
unclassified path	full run	note + select nothing extra
push with no predecessor / missing predecessor	full run	note + empty range
descriptor / member change	select members	select members (unchanged)

Why

Touching this file was enough to trigger a full run, which is the case that keeps biting: a one-line CI edit cannot be reviewed against a fast signal. Measured three times today — #390, #391 and #392 each ran a ~22-shard matrix to validate a change whose blast radius was one job. On top of that, the PR's own legs queue behind all of it, so the thing under review reports last.

One consequence handled

widen does not exit, so the push-with-no-predecessor path has to leave a usable range. HEAD alone would diff root-to-HEAD, name every file and select every member — a full run by another name, which is what this PR exists to stop. It leaves the range empty instead; the reason is already printed and the summary carries it to a human. Rare either way: merges here are squashes, so event.before is present on every normal push.

The weekly sweep is deliberately kept

Sunday 06:00 stays full. It is the only thing that would have caught the windows vulkan regression before a user did — main's leg was pinned to windows-2022 in #385 and the vulkan members were never re-tested there until a full run happened to fire today. Removing automatic full runs on PRs while keeping a periodic net is the same shape openxlings/xim-pkgindex#815 just added on the other side.

If you want the cron gone too, it is one line — say so and I will drop it.

Verified

Rendered shell fragment, run standalone:

# event = pull_request, diff = validate.yml + compat.vulkan.lua + weird/thing
note: ".github/workflows/validate.yml" would once have forced a full run; ...
note: "unclassified change: weird/thing" would once have forced a full run; ...
MEMBERS=[vulkan]  UNTRUSTED=[.github/workflows/validate.yml; unclassified change: weird/thing]

# same input, event = workflow_dispatch
FULL RUN: .github/workflows/validate.yml

ruby -ryaml parses the workflow.

This PR is its own first test: it edits validate.yml, so under the old behaviour it would have forced a full matrix. If it selects nothing instead and says why, the change works.