ci: scope checks to affected Rust packages and platforms

[Tryanks]

Documentation and edits to existing bundled Orchestrate prompts currently run every desktop and mobile check. This change skips those heavy jobs and uses Cargo-Rail 0.25.0 to select affected Rust packages for build, Clippy, and tests. Target-specific Cargo dependency trees select iOS, Android, and Web checks independently, including their toolchain setup.

The repository policy handles non-Cargo inputs and widens uncertain changes to full checks. Five fixed required-check names are preserved through separate desktop jobs sharing one composite action; planner failures fail those checks instead of producing a false green. The Cargo executor distinguishes workspace scope from package scope and stops before execution if the upstream reader fails. Dependency hygiene uses a prebuilt, pinned cargo-machete.

Validation:

• 13 integration/executor tests passed, exercising the released Cargo-Rail binary, real temporary Cargo/Git workspaces, platform dependency activation, excluded path dependencies, prompt deletion/rename, empty plans, and reader failures.
• actionlint, composite YAML parsing, and git diff --check passed.
• Full local cargo fmt, Clippy, workspace build and tests passed. Direct cargo-machete 0.9.2 scan passed; the literal cargo subcommand has a previously observed local invocation incompatibility.
• All six checks passed on commit 87a6da1: full CI run, including all three desktop platforms, dependency hygiene, and iOS/Android/Web.
• Documentation-only remote probe: the planning job took 17 seconds; all five required names appeared as skipped with no runner allocated.
• Headless-source remote probe: build, Clippy, and test selectors were exactly -p tcode-headless; all three desktop consumers and dependency hygiene passed, while Mobile and web checks skipped. Native installation, checkout verification, and typed package execution succeeded on macOS, Linux, and Windows. The temporary probe PR is closed without merging.

No Rust sources, dependencies, model configuration, or branch-protection settings change. Unknown resources and build configuration changes deliberately retain full checks.