ci: Run mutation testing in parallel and gate merges through CI gate

[bitbiter-dev]

Why

Stryker was ~72% of the single Build & Test job (7m04s–7m30s of ~10m20s), and both Docker builds waited behind it, so the required checks took ~12 min.

What

Job	When	needs
Checks	always	– (build, test, coverage, format, helper scripts, schema check)
Mutation	always	– (Stryker, report, badge/high-water payloads)
Docker — API/Worker	PRs, and dispatch without push_to_registry	Checks — build only, no push
CI gate	if: always()	Checks, Mutation, Docker
Publish image — API/Worker	master, v* tags, dispatch with push_to_registry	CI gate
Publish quality reports	master	Checks, Mutation (runs even if the mutation gate fails)
Deploy quality reports to Pages	master	Publish quality reports
Schema diagram	always	– (no longer waits)

• Expected PR gate: ~8.5 min (Stryker is the floor; Checks → Docker finishes at ~5 min).
• No image is pushed before everything is green. Pushing only happens after CI gate, on master and tags alike.
• scripts/ci-gate.sh (tested by ci-gate.test.sh, test-first) holds the gate's rule. GitHub treats a skipped required check as passing, so every need must succeed. The one exception is the PR-only Docker build, which may be skipped outside pull requests.
• Jobs downstream of the gate check needs.<job>.result explicitly. The implicit success() also sees the transitively skipped PR Docker job, so without the explicit check they would be skipped on every push.
• contents: write only exists in the master-only publish job. PR jobs get a read token.
• cancel-in-progress applies to PRs only, so every master commit finishes its image push and high-water advance.

Considered and rejected: Checks/Mutation as direct required checks (every job rename would need a protection change), keeping the name Build & Test, letting Docker push right after Checks, a separate format job, and NuGet caching (restore is ~5 s, and setup-dotnet caching needs lock files).

⚠️ Rollout

This PR no longer reports Build & Test, so it stays blocked until the required checks are swapped. Immediately before merging, once every check on this PR is green:

gh api -X PATCH repos/bitbiter-dev/anichron/branches/master/protection/required_status_checks --input - <<'JSON'
{"strict":true,"checks":[{"context":"CI gate","app_id":15368},{"context":"CodeQL","app_id":57789}]}
JSON

Open PRs (#236, #228, #229) pick up the new workflow when they are next brought up to date, which strict already forces.

Verification

• actionlint is clean on all workflows. All helper-script suites pass, including the new ci-gate.test.sh.
• /code-review: no correctness findings. The dispatch smoke-build regression it flagged is fixed.
• The real proof is this PR's own run: compare its wall clock with the ~12 min baseline.

🤖 Generated with Claude Code