Move the ARMv6 leg out of core CI into a workflow of its own

[chrisuthe]

linux-armv6 emulates every compile under qemu-user inside a Raspbian container: 23 minutes measured, where every other leg in the matrix finishes in under three and a half. As a matrix leg it ran whenever the matrix ran — every branch push, and again on every pull request — so every push waited half an hour on the leg that almost never had anything new to say.

The split

.github/workflows/build-armv6.yml is a new one-job workflow holding that leg with every matrix.* branch collapsed to the container-only side. It carries its own triggers:

• workflow_call, so release.yml calls it
• push: branches: [main] — post-merge coverage
• pull_request filtered to .github/workflows/build-armv6.yml, scripts/build_armv6_container.sh and CMakeLists.txt
• workflow_dispatch

No unfiltered branch push, which is the cost being removed.

build.yml loses the leg and everything only it used: the container matrix key, the emulator-registration and container start/stop steps, and every if [ -n "\$IMAGE" ] branch in Configure, Build, Test, Smoke test, Package and the architecture assertion. matrix.arm32 stays — linux-armv7 still uses it.

release.yml calls both workflows and its release job needs both, so a red ARMv6 build fails the release rather than publishing without its archive. The two expected-asset lists are untouched and still name sendspin-cli-\$VERSION-linux-armv6.tar.gz.

Nothing the leg proved is lost

Every assertion survives: QEMU_CPU=arm1176 throughout (configure included), the configure-output expectations for backends and mDNS, Tag_CPU_arch: v6 and Tag_ABI_VFP_args: VFP registers read off the linked binary, the GLIBC_2.36 bookworm ceiling, the EMULATED BUILD-INFO.txt block with its glibc floor read off the binary, the payload file-list diff against both the staged tree and the tarball, -Wno-error=restrict as the single warning exemption, --init with a non-root build user, and if: always() on the container stop. The cache key is the same literal deps-linux-armv6-<hash>, so existing caches still hit.

The concurrency guard

build-armv6.yml keeps a concurrency block — cancelling a superseded run is worth more on a 25-minute job than anywhere else here — but cancel-in-progress is conditioned on the ref rather than the workflow name:

cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}

Two runs share a group only if they share a ref, a release run's ref is always a tag, and no tag-ref run cancels anything — so the guard holds whatever github.workflow resolves to inside a called workflow, which is a fact this repo cannot test without cutting a release. release.yml's no-concurrency comment now says that its tag-only trigger is load-bearing for this, so a later workflow_dispatch there cannot silently re-open the window.

The trade, written down

A tag now builds one thing a push does not. build.yml's header no longer claims a release is gated on exactly what a push is gated on, and neither does release.yml or ROADMAP item 10. What bounds the cost: the tip of main gets an ARMv6 build within half an hour of a merge, and the release path still blocks on a green ARMv6 build. The pull_request path filter is deliberately honest about its reach — it catches infrastructure changes, not the ARMv6-only source breaks this project has actually met (the gcc 12 -Wrestrict false positive and the -latomic class), which are caught after the merge instead.

Also in here

The matrix timeout-minutes comes down from 40 to 20. That 40 was sized for ARMv6 alone; 20 is sized off recent runs — linux-armv7 is the slowest remaining leg at ~3m09s and macos-arm64 comes in under two minutes, so it leaves better than five times the slowest measurement.

Comment debt swept where the old arrangement was named: ci.yml, scripts/build_armv6_container.sh (including the message it prints to a developer whose container died), scripts/build_arm32.sh, scripts/get_started_linux.sh, README's "## CI", ROADMAP items 10 and 12, and docs/wiki/Installation.md.

Checks

actionlint is clean on all five workflows and shellcheck scripts/*.sh passes. This PR touches its own workflow path, so it runs linux-armv6 through the new file's path filter — which is what stands in for a workflow_dispatch that is not available until the workflow is on the default branch.