Run selective parallel CI on 8-vCPU Blacksmith runners

[VibeSWE]

Description

PR updates currently trigger duplicate frontend workflows, serialize browser/lint/test suites, and compile the integration image separately for each deployment. Run Linux checks on Blacksmith 8-vCPU Ubuntu 24.04 runners and select work through one CI workflow with a final CI passed check.

• Run four Playwright UI shards alongside production/Storybook tests; run Clippy alongside Rust tests. Cancel superseded PR runs and restrict automatic push CI to main.
• Build one Docker image using Blacksmith's persistent layer cache, then share it between standalone/distributed integration jobs. Move frontend embedding after Rust dependency compilation so UI edits preserve that layer.
• Keep Quest functional tests on PRs, excluding its six sustained k6 tests. Main and nightly runs retain full Quest load tests and upload Rust coverage. Frontend-only changes still validate embedded UI serving; backend-only changes skip browser tests.
• Cache release builds by compiler/target/features/profile, use native Blacksmith ARM runners for Linux ARM builds, and provide an opt-in thin-LTO experiment that uploads artifacts without publishing releases. Production stays on fat LTO.
• Document CI modes and configure actionlint for Blacksmith runner labels. Update two legacy checkout actions flagged by current actionlint.

Validation

• actionlint 1.7.12 passes all workflows; YAML, shell syntax, and git diff --check pass.
• Standalone/distributed smoke Compose configs use the shared image and correct Quest entrypoint; local/full mode remains load by default.
• Checked actual Quest image: filter retains 33 top-level functional tests and excludes six k6 tests.
• Tested path-routing cases for frontend, Rust, build scripts, CI files, and docs-only changes.
• Blacksmith CI passed on 4df54b6: all 15 CI jobs succeeded; CLA was skipped as expected for this fork. Run.
• End-to-end PR elapsed time: 11m45s versus a prior 12-revision median of 29m29s (about 60% shorter). Frontend group 1m42s; Rust group 7m37s; integration including shared image build 10m05s. This measures the combined pipeline and runner changes, including deferring sustained load/coverage; it is not an isolated hardware benchmark.
• Some Docker layers were cached, while Rust dependencies still compiled. Full main/nightly mode and release/thin-LTO builds have not yet run under this configuration.
• Independent Sol/Opus review completed. Fixed the observed cargo-hack --locked incompatibility before the successful run.

No branch-protection settings or publishing workflows were executed.