ci: label-triggered stagex builds and cache/credential fixes

[shahan-khatchadourian-anchorage]

Summary

• stagex.yml: PR image builds now require the stagex label instead of auto-triggering on path changes. Push to main/tags with path filtering unchanged. GHCR credentials moved after build step so build runs without registry write access.
• main.yml: Disable setup-rust-toolchain built-in cache (Swatinem/rust-cache) which fails because Cargo.toml is in src/, not the repo root. The manual actions/cache step already handles caching correctly.

Test plan

• Verify adding stagex label triggers the build on a PR
• Verify push to main with relevant path changes still triggers the build
• Verify GHCR push still works on push to main
• Verify Continuous Integration no longer shows Cargo.toml not found errors

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Restructures GitHub Actions workflows to separate fast, always-on validation from the heavier OCI image build pipeline, aligning CI triggers with the intended PR label–based build flow and adding musl cargo check coverage to match container build settings.

Changes:

• Split workflows into check.yml (runs on every push/PR) and ci.yml (full image build on push/main/tags, manual dispatch, or PR ci label).
• Add musl (x86_64-unknown-linux-musl) cargo check for parser_app and parser_gateway with --no-default-features.
• Gate GHCR upload to push events only.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/check.yml	Removes branch filters and adds musl cargo check steps to validate container-equivalent build configs.
.github/workflows/ci.yml	Changes PR trigger to label-based, adds job-level gating for ci label, and restricts GHCR upload to push events.

Comments suppressed due to low confidence (3)

.github/workflows/check.yml:61

• The new musl cargo check --target x86_64-unknown-linux-musl steps will often require a musl linker/toolchain on Ubuntu runners (e.g., musl-tools, and sometimes pkg-config/musl-dev depending on dependencies). Add an explicit install step before these checks so the workflow doesn't fail due to missing musl-gcc/linker tooling.
  .github/workflows/ci.yml:21
• Since this job now runs on pull_request (label-triggered), be careful not to pass registry credentials during PR runs. The current workflow still runs the Docker setup composite action with DockerHub/GHCR tokens, which makes those credentials available to PR code even if the upload step is push-only. Consider gating the login/credential passing to push events (or moving login/push into a separate push-only job) so PR builds never receive registry write credentials.
  .github/workflows/ci.yml:24
• The job runs on pull_request (label-triggered) but grants id-token: write and packages: write to the PR workflow run. This is an unnecessary privilege escalation for PR builds and increases the blast radius if a workflow change is introduced in a PR. Consider splitting into separate jobs so PR builds run with read-only permissions, and only the push-triggered job has packages: write/id-token: write for publishing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[shahan-khatchadourian-anchorage]

Superseded by PR #232 which now incorporates these changes (commit 2bf5b2c).