ci: split CI into reusable workflows (#7168)

## Why

The monolithic CI workflow is a frequent merge-conflict hotspot.
Splitting cohesive domains into same-repository reusable workflows keeps
one centrally filtered entry point while letting Rust, desktop,
relay/PostgreSQL, client, and security CI evolve independently.

## What

- Keep `ci.yml` as the only push/pull-request orchestrator with
unchanged concurrency and path detection.
- Move 18 execution jobs into five `workflow_call`-only domain workflows
without changing their runners, steps, matrices, caches, artifacts,
permissions, or timeouts.
- Keep the relay artifact producer with desktop integration, the
complete PostgreSQL lane, and relay E2E consumers.
- Preserve all 12 existing required GitHub Actions contexts through
lightweight top-level compatibility gates, so the repository ruleset
does not need to change.
- Update the Rust-cache contract to follow Unit Tests into
`_ci-rust.yml`.

## Risk Assessment

CI-only change with moderate workflow-orchestration risk. The main risks
are reusable-workflow output propagation, skip behavior, and visible
check naming; the old required names remain explicit top-level jobs, and
the draft will stay open until an exact-head GitHub Actions run and
independent review are complete.

Generated with Codex

---------

Signed-off-by: Luke Tornquist <tornquist@squareup.com>
Signed-off-by: tornquist <tornquist@squareup.com>

scripts/test-rust-cache-contract.sh

@@ -91,9 +91,9 @@ cache_uses.each do |path, location, ref|
   end
 end
 
-ci_path = root / ".github" / "workflows" / "ci.yml"
-ci = workflows.fetch(ci_path) { load_workflow.call(ci_path) }
-jobs = ci["jobs"]
+rust_ci_path = root / ".github" / "workflows" / "_ci-rust.yml"
+rust_ci = workflows.fetch(rust_ci_path) { load_workflow.call(rust_ci_path) }
+jobs = rust_ci["jobs"]
 unit_tests = jobs.is_a?(Hash) ? jobs["unit-tests"] : nil
 abort "unit-tests job missing" unless unit_tests.is_a?(Hash)
 steps = unit_tests["steps"]