perf(ci): trim renderer, Storybook and CLI candidate waits

[orangeCatDeveloper]

Summary

Three core-CI steps did work nothing consumed. Check renderer architecture ran on every code change although it parses only apps/desktop, and parsed the base tree after the current one; Build Storybook built the manager, docgen and sourcemaps for a smoke that opens iframe.html only; Build CLI release candidate cleaned and recompiled the workspaces the Build step had just compiled. Plan the renderer check from the paths it reads, parse the base tree on a worker thread, build the smoke Storybook with --test --preview-only, and let the candidate reuse the compiled workspaces via a new --reuse-build flag that is only accepted with --allow-dirty, so release builds still clean.

Expected saving per run on Apache runners: about 45 s when a PR touches apps/desktop, about 70 s when it does not. performance-frontend.yml keeps the production Storybook build its measurements are calibrated against.

Verification

Controlled A/B on a fork, one runner per arm, identical plan (BASE_SHA set, full suite). Per-step seconds; the unchanged steps agree within 2 % between arms.

                                 main   this PR
Check renderer architecture        22        17   (round 5; --base mode, checker identical to base)
Build Storybook                    30         9
Storybook smoke                   242       240   (399 renders, all passed)
Transcript geometry invariants     15        16
Build CLI release candidate       189       172   (TS rebuild 14 -> 3 s; the Rust cache misses on a fork branch)

unchanged, for scale:
Typecheck                          10        11
Run affected standard workspace   282       284

Local, apps/desktop: node scripts/check-renderer-architecture.mjs --base HEAD --strict-base 6.0 s -> 3.7 s; the checker's own suite stays at 3.5 s (112 passed). storybook build --test --preview-only 9.1 s -> 3.3 s locally with the smoke unchanged at 57 s.

• scripts/ci-test-plan.test.mjs, scripts/ci-workflow-policy.test.mjs: 87 passed
• apps/desktop/scripts/check-renderer-architecture.test.mjs: 112 passed
• Not run: the --reuse-build path end to end outside the fork A/B; the candidate it produced passed Validate installed CLI release candidate there.

Review focus

--reuse-build is the one change that skips a step: the candidate tarball is packed from the dist/ the Build step produced instead of a clean recompile. It is CI-only (--allow-dirty is required), and a real release still runs buildFromCleanDependencyTree.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code profiled the steps, wrote the planner gate, the worker-thread split, the Storybook flags and the --reuse-build flag, and ran the fork A/B.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No