CI overhaul (6/9): trim the fast lane to PR-only and align the main ruleset

[thiagobrez]

Part of the CI overhaul execution plan (#59, map #53). Order: 6 of 9 — blocked by 2/9 (#66) and 5/9 (#69). The ruleset edit lands with this PR's merge, not before.

Decision: #57, recorded in ADR 0006 (2026-09-02 amendment, PR #62).

Scope

PRs run only the fast set under a ≤10-minute wall-clock budget; fast workflows stop running on push to main (the ruleset's strict up-to-date policy makes those runs redundant).

• ci.yml: drop the push: main and merge_group triggers; delete the build-library job (strict subset of test); drop --coverage from the test run (collected 2×, enforced nowhere); make the dead cocoapods-cache condition live by adding the actual Pods cache step in build-ios.
• docs.yml: drop push: main and merge_group triggers.
• performance.yml: drop the merge_group trigger.
• changeset-requirement.yml: unchanged (already PR-only).

Ruleset / required-check changes (same task, applied via gh api at merge time — needs admin)

Required checks on main become exactly: lint, test, build-android, build-ios, docs build, geometry, render-regressions, Changeset requirement. Removed: build-library and Approve exact tarball for publication (removing the tarball check now is what lets 7/9 drop the candidate from PRs without deadlocking them). Sequence within the task: apply the ruleset edit immediately before merging this PR, so no PR is ever blocked on a check that no longer runs.

Acceptance criteria

• A fresh PR shows exactly the fast set as merge-blocking checks and goes queue-to-green in ≤10 minutes.
• build-ios gets a Pods cache hit on the second run.
• No fast workflow runs on push to main after merge; main stays green.
• Ruleset state verified via gh api repos/{owner}/{repo}/rulesets matches the list above.

[thiagobrez]

Landed in #93 (6f6f04a), with the main ruleset edit applied via gh api immediately before the merge.

Acceptance criteria:

• Fast set as the merge-blocking checks, queue-to-green in ≤10 minutes — met. The four fast workflows on ci: trim the fast lane to PR-only and align the main ruleset #93 all started 17:52:43Z and finished by 18:00:58Z: 8m15s. Required contexts are now exactly lint, test, build-android, build-ios, docs build, geometry, render-regressions, Changeset requirement. (Exact package candidate still ran on the PR — 36m — but is no longer merge-blocking; 7/9 removes it from PRs.)
• No fast workflow runs on push to main; main stays green — met. The merge push triggered only Exact package candidate; no CI or Documentation push runs, unlike the previous merge (9a50e91).
• Ruleset state matches — verified via gh api repos/thiagobrez/react-native-reorderable/rulesets/21604857. build-library and Approve exact tarball for publication workflow removed; geometry and render-regressions added; strict up-to-date policy retained.
• build-ios Pods cache hit on the second run — partially verified. The step works and saved a 312 MB entry (macOS-cocoapods-b68935c0…), but it is scoped to refs/pull/93/merge, so only a second run within the same PR hits it. See the caveat below.

Follow-up worth a ticket: because ci.yml no longer runs on push to main, nothing repopulates branch-scoped caches on refs/heads/main, and GitHub only lets a PR restore caches from its own ref or the base branch. The Pods cache will therefore never seed across PRs, and the pre-existing Linux-turborepo-*/macOS-turborepo-ios-*/gradle entries currently on refs/heads/main were written by the old push runs — they will age out (7 days unused) or fall out of date on the next yarn.lock change, after which every PR's first build-ios/build-android becomes a cold build. This is an accepted consequence of the PR-only fast lane rather than a defect in this change, but the ≤10-minute budget depends on those caches, so it should be measured once the main entries expire and, if it bites, addressed with a scheduled cache-warming run on main.