ci: slim release-please heads and stop compiling on main

[SebTardif]

Summary

Upgrade CI/CD to the canact Recipe A / Recipe G / notes-branch layout. No product TypeScript change. ci: so this does not bump the extension.

Why

Every feat/fix merge force-pushes release-please--* and was re-running the full 3-OS unit + build + integration + UI + CodeQL matrix. ci.yml also compiled again on push to main, and post-merge.yml dispatched ci.yml + security.yml after every squash (a second matrix). FOSSA re-scanned every merge because paths: was missing.

What changed

• Recipe G: release-please* heads skip windows/macos unit, integration, and UI. Required ci still reports via ubuntu npx tsc --noEmit. Required CodeQL analysis stays named and runs a quoted echo stand-in (no checkout/init/analyze). npm audit / Trivy / Gitleaks / DCO keep reporting. FOSSA may skip those heads.
• Recipe A: ci.yml and security.yml no longer run on push to main. post-merge.yml keeps Scorecard dispatch only. Did not flip strict_required_status_checks_policy (that re-blocks release-please; tech-debt: release PRs blocked by required status checks policy even when green #156).
• FOSSA: same paths: on push and pull_request (package.json, package-lock.json, src/**, the workflow file).
• Notes-branch: scripts/apply-release-notes.sh + cheap apply workflow. Tag patchloom-v0.6.0 -> branch release-note-0.6.0. Legacy RELEASE_NOTES.md on the tag checkout still applies. Cleanup PR stays until the first notes-branch cut succeeds. Publish stays in the existing Package and Upload job.

Verification

• python3 ~/.grok/skills/ci-build-once/scripts/inventory-waste.py -> 0 findings (W2/W7/W8 gone)
• actionlint on touched workflows
• python3 scripts/test_workflow_triggers.py (8 tests)
• python3 scripts/test_apply_release_notes.py (8 tests)
• npm run check (433 pass, 9 skip)

Required check names unchanged: ci, npm audit, Trivy vulnerability scan, Gitleaks secret detection, DCO sign-off, CodeQL analysis.

Checklist

• All commits in this pull request are signed off with git commit -s
• I ran npm run check and it passes
• I updated docs if user-facing behavior changed
• I am contributing this work under the repository license (MIT)