[CI] Make MatterViz the required GUI gate

[Stardust0831]

Problem

The active main ruleset still requires historical CI contexts:

• Package Multiwfn GUI (Linux)
• Package Multiwfn GUI (macOS)
• Package Multiwfn GUI (Windows)
• GUI Linux glibc 2.28 compatibility
• noGUI (ubuntu-latest)
• noGUI (macos-latest)
• noGUI (windows-latest)
• Core source guard

The current MatterViz checks are not required:

• MatterViz frontend and Rust host
• Package MatterViz WebView (Linux)
• Package MatterViz WebView (macOS)
• Package MatterViz WebView (Windows)

This was inherited from the Qt/3Dmol transition. PR #52 makes the obsolete GUI and platform-specific noGUI contexts lightweight compatibility gates, which reduces CI cost but also makes the missing MatterViz requirement more visible: a failed MatterViz Windows/macOS/Linux package job does not currently block merging.

Related work:

• PR feat(matterviz): add signed prerelease self-updater #51: feat(matterviz): add signed prerelease self-updater #51
• PR ci: retire redundant legacy GUI validation #52: ci: retire redundant legacy GUI validation #52

Constraint

The individual MatterViz jobs cannot simply be added to the ruleset today. .github/workflows/matterviz-gui.yml uses pull-request path filters, so unrelated pull requests would never create those check contexts and could remain blocked with missing required checks.

Release and pull-request artifact trust boundaries must remain separate. This issue must not promote untrusted PR artifacts into release jobs.

Proposed design

Add an always-present aggregate check, for example MatterViz required gate:

1. Run a lightweight changed-files classifier for every pull request.
2. For MatterViz, shared build, packaging, or Multiwfn core changes, run and require:
   • frontend and Rust Host validation;
   • Linux MatterViz package;
   • macOS MatterViz package;
   • Windows MatterViz package.
3. Make the aggregate gate fail if any required upstream job fails or is unexpectedly skipped.
4. For unrelated documentation, tooling, or Linux-headless-only changes, let the aggregate gate pass in a few seconds without running the native package matrix.
5. Keep release tags rebuilding and testing their own same-run artifacts.

The classifier should be conservative: unknown or shared source paths must select the full MatterViz validation path.

Ruleset migration

After the aggregate gate is proven on live pull requests, update the main ruleset to require:

• Core source guard
• MatterViz required gate
• the retained Linux headless/noGUI gate, if still independently needed

Then remove the historical required contexts for:

• Qt/3Dmol GUI package jobs;
• Qt/3Dmol glibc compatibility;
• macOS and Windows noGUI jobs.

The temporary lightweight compatibility jobs in PR #52 can then be removed.

Implementation order

1. Merge or otherwise stabilize PR feat(matterviz): add signed prerelease self-updater #51 so the final updater-aware MatterViz workflow is the implementation base.
2. Add changed-file classification and the aggregate gate.
3. Verify with at least two live PR cases:
   • a MatterViz-relevant change where an intentionally failing package job blocks the gate;
   • an unrelated change where the gate appears and passes without native package builds.
4. Update the repository ruleset.
5. Remove the transitional compatibility contexts.
6. Confirm tag/manual release behavior remains unchanged.

Acceptance criteria

• Every pull request reports one stable MatterViz required gate context.
• MatterViz-relevant changes cannot merge when any frontend/Host or Linux/macOS/Windows package job fails.
• Unrelated changes do not run the MatterViz native package matrix.
• No required check remains permanently missing because of workflow path filters.
• Old Qt/3Dmol and macOS/Windows noGUI contexts are removed from the ruleset.
• Preview and formal tag builds continue to create and publish only same-run verified artifacts.