Adopt the two-phase CI/CD pattern from ProjectTemplate (PR smoke builds + opt-in publish)

[ptr727]

Port the two-phase CI/CD pattern just implemented in ProjectTemplate (ptr727/ProjectTemplate#97 → #98, merged to develop) into PlexCleaner. This issue captures exactly what was done there so the work can continue here. PlexCleaner's workflow layout is essentially identical to ProjectTemplate's pre-change layout, so the port is mostly mechanical — minus PyPI (PlexCleaner has no PyPI library; its targets are the Docker image and the console executable 7-runtime build).

Goal

Decouple merging from publishing. PRs get fast, path-gated smoke builds; the full multi-arch build/publish moves to a weekly schedule + manual dispatch, with an opt-in switch for publish-on-merge.

Target architecture (mirror of ProjectTemplate #98)

1. Thread ref / branch / smoke through every reusable task. Branch-derived config (main ⇒ Release/latest, else Debug/develop/prerelease) must key off inputs.branch, never github.ref_name — the weekly publisher builds both branches from one run. get-version-task.yml gains a ref input.
2. smoke mode: Docker builds linux/amd64 only (skip QEMU); executable builds a representative runtime subset (e.g. linux-x64 + win-x64) instead of the full 7; nothing pushes.
3. build-release-task.yml: add smoke, ref, branch, and per-target enable_* gates. smoke hard-disables every push (&& !inputs.smoke).
4. test-pull-request.yml: add a dorny/paths-filter changes job (needs permissions: pull-requests: read), gate per-target smoke jobs on it, keep unit tests always-on, and extend the check-workflow-status aggregator to require the changes job succeeded (so a filter error can't merge a target-changing PR with its smoke skipped). Build-workflow files are intentionally excluded from filters.
5. publish-release.yml: become the single publisher — push + weekly schedule + workflow_dispatch. A setup job computes the branch list (schedule/dispatch ⇒ both branches, push ⇒ the pushed branch) and a publish gate github.event_name != 'push' || vars.PUBLISH_ON_MERGE == 'true'. Build both branches via a matrix. Absorb publish-periodic-docker-release.yml (delete it). Use a global concurrency group (group: ${{ github.workflow }}, not ref-scoped) + cancel-in-progress: false.
6. Consolidation: fold unit tests into the PR workflow and delete test-release-task.yml. Default PUBLISH_ON_MERGE unset ⇒ two-phase.

Refinements discovered during the ProjectTemplate Copilot review — bake these in from the start

These were review findings on #98; apply them directly so PlexCleaner doesn't repeat them:

• Make branch a required input on every task (no ${{ github.ref_name }} default — it's a footgun that would mislabel the develop leg of the matrix).
• Check out the PR head by SHA in the smoke job: ref: ${{ github.event.pull_request.head.sha || github.ref_name }} (works for fork PRs; head_ref does not).
• Branch-suffix all upload-artifact names (executable-build-${branch}, per-runtime publish-${branch}-${runtime}, etc.) so both matrix legs coexist in one run without collisions. (PlexCleaner uploads the executable 7z, so this matters; the GitHub release downloads by artifact-id which is unaffected.)
• Branch-scope the Docker registry cache (buildcache-${branch}, read both branches, write own) and gate cache-to on inputs.push (non-publishing builds never write cache or need write creds).
• Gate the github-release job on && !inputs.smoke so smoke can never create a release.
• Skip GitHub release creation when the version tag already exists (gh release view "$SemVer2") — weekly no-op weeks shouldn't churn/fail the release. (Same fix filed for NxWitness: Publisher: skip duplicate GitHub release on no-op weeks and pin release tag to the built commit SHA NxWitness#407.)
• Pin the release target_commitish to NBGV GitCommitId (immutable, right branch) instead of github.sha (wrong on the develop leg) or a branch name (moving ref). Surface GitCommitId as a get-version output.
• Docker Hub login: ProjectTemplate consciously keeps always-login (private repo, higher pull rate limits) and documents the trade-off (fork PRs can't run the Docker smoke). Decide per PlexCleaner's visibility — gating login on inputs.push is the alternative.
• Linting stays editor/workspace + commit gate — no CI lint job. Don't claim actionlint runs in CI; lint workflows locally before pushing.
• CodeGen cadence: if PlexCleaner has scheduled codegen, move it to daily (cheap under two-phase).

PlexCleaner-specific notes

• Targets are Docker + executable only (no NuGet/PyPI) — drop those enable_*/jobs/filters.
• PlexCleaner currently has a redundant merge-time Docker build (built non-pushed in the release path, pushed in the periodic workflow). The unified publisher removes that duplication.
• Consider whether develop mutable-tag republishing on routine merges should stop (it does under two-phase by default).
• Per-target modularity + the subsetting checklist should be documented in PlexCleaner's AGENTS.md, same as ProjectTemplate.

Reference

• Implementation to port: ptr727/ProjectTemplate#98 (all reusable tasks + publish-release.yml + test-pull-request.yml).
• Related NxWitness back-port: Publisher: skip duplicate GitHub release on no-op weeks and pin release tag to the built commit SHA NxWitness#407.

🤖 Filed by Claude Code; ready to continue the work directly in PlexCleaner.

[ptr727]

Two additional release-job refinements (surfaced by Copilot while back-porting these fixes to NxWitness — ptr727/NxWitness#408). Fold these into the github-release job when porting:

1. Check out the tagged commit, not a moving ref. When target_commitish is pinned to NBGV GitCommitId, the release job's checkout must use the same commit (ref: ${{ needs.get-version.outputs.GitCommitId }}) — not ref: main/a branch. Otherwise the uploaded release files can come from a newer commit than the tag if the branch advances mid-run.

2. Don't let the skip-if-exists gate block workflow_dispatch. Gate the release-creation step as if: ${{ steps.release-exists.outputs.exists == 'false' || github.event_name == 'workflow_dispatch' }} — so the no-op weekly schedule still skips a duplicate release, but a manual dispatch can always re-run to repair/refresh a partially-created release for the same tag.

(These also apply to the original ProjectTemplate implementation and will be fixed there as a follow-up.)

[ptr727]

Third release-job refinement (from NxWitness #412): make the "Check for existing release" step's log message event-aware. When the release already exists, the step logs "skipping…", but a workflow_dispatch is allowed through (per the gate in the previous comment), so the log misleads. Branch the message on github.event_name: on workflow_dispatch say it will refresh the release, otherwise say it's skipping the no-op republish. Log-string only.

NxWitness backport is now fully merged to main (PRs #408, #412, #411; issue #407 closed).