ci: moon concern matrix; dissolve gates; gate every leg (RIG-2700 T5)

[rigel-mintaka]

Reverse the one-job CI decision the final way the frozen decomposition plans:
replace the monolithic gates job with a moon-owned concern matrix and gate
every special-infrastructure leg on a computed affected flag, so a PR pays only
for the concerns it touches and each concern reports as its own named check.

A new setup job runs a bun/TS generator (tools/ci-matrix/) that reads moon's
own affected closure (moon query projects --affected --upstream deep --downstream direct on a PR; the full set on push/schedule) and every project's
ci-group.<name> tag, then emits the GitHub Actions matrix plus four special-leg
affected flags. moon owns discovery; the generator owns only grouping, and fails
loud — naming the offending project — on any untagged or double-tagged project or
coverage gap, so there is no hand-maintained YAML project enumeration to drift.
The pure translation core is exhaustively unit-tested; the workflow step is a
thin impure shell around it.

The moon matrix job fans out one leg per concern group (go / bun / nix / forks)
discovered at run time, fail-fast: false, no continue-on-error. An unaffected
group runs as a seconds-long green placeholder so the check names stay stable and
the matrix is never empty. The four special legs (pgtest, microVM, forge oracle,
gtk3 e2e) each gain needs: setup and a job-level gate on their paired flag; the
CI rollup requires plain success from setup and moon and accepts a special
leg's skip only when its paired flag is false (a failed setup leaves the flag
empty, so the skip is not excused and the rollup reds — fail-safe, never blanket
skipped-is-green).

Tag scheme uses a DOT delimiter (ci-group.bun), not the colon the record first
drafted: moon 2.5.3 tag ids forbid a colon. renovate-preflight gains a ci
aggregate task, closing a latent silent-skip where the moon sweep passed it over.
ci-matrix is registered in .moon/workspace.yml so the generator's own project
is discoverable and its ci-group.bun tag is covered by the very assertion it
enforces.

Refs RIG-2700

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-2700

[github-actions]

Compass engineering docs preview: https://compass-runner-2700-ci-moon.compass-eng-docs.pages.dev

Deployed from compass-runner/2700-ci-moon-concern-matrix at 2170d37.

Changed pages:

• docs/designs/infra/ci/compass-ci-job-decomposition/design.md

The base branch was changed.