ci: refactor verification workflows into shared reusable units

[mobileskyfi]

Purpose

Track the future CI/refactoring work for quickchr verification workflows. The exact shape is intentionally not fixed yet; the main goal is to stop maintaining parallel verification logic in ci.yml, verify-extended.yml, and publish.yml, and to make shared workflow units composable enough for release gates, manual Extended Verification, and lab-style troubleshooting runs.

Current workflow shape

• ci.yml is the push/PR quality gate: repo checks, unit coverage, linux/x86 integration, then Windows unit tests.
• verify-extended.yml is manual and platform-selectable: integration and/or examples smoke across Linux, macOS, Windows, RouterOS target, and filters.
• publish.yml still carries its own release verification jobs instead of reusing the same units.
• lint-powershell.yml has already been split out and reused from Extended Verification; that part is no longer open here.

Refactor direction

Likely outcome: shared workflow_call units for the recurring pieces, with small wrapper workflows for push/PR CI, release publish, and manual/lab dispatches. The integration runner is the key unit to design carefully: it should be parameterized by platform, RouterOS target, test filter, artifact names, gating/non-gating behavior, and optional metrics collection.

Related CI work captured here

• ci: collect Extended-Verification coverage as a byproduct of the integration jobs (no second run) #30 is folded into this issue. Integration tests should collect coverage/stats as a byproduct of the existing per-file integration run, not by running the suite a second time. Treat this as broader than raw coverage if useful: a centrs-style test summary/statistics scheme may be a better target than only lcov percentages.
• Windows support: first-class support research and alignment (umbrella) #40 is not a CI-refactor issue, but Windows-first-class work will likely need the lab/manual workflow shape from this issue so Windows findings can be reproduced outside normal gating.
• Cross-platform validation matrix (Linux host, completions, disk sizing) #42 is validation matrix work, not a request to broaden normal push/PR CI by default. Shared manual/lab workflow units may make it easier to run those checks.
• QEMU watch-items (boot respawn-once, arm64 QGA) #45 is QEMU/test-watch research rather than CI refactoring; it may consume lab/repro workflow support if that falls out of this work.

Non-goals

• Do not turn every platform validation issue into regular PR gating by default.
• Do not reintroduce a duplicate standalone Extended Verification coverage job.
• Do not track general diagnostics/enhancement work here. doctor --export (CLI: doctor enhancement + --export bug-report bundle #47), machine evidence descriptors (API: stable machine-evidence descriptor for harnesses #50), and error/help alignment (CLI: error diagnostics chain (grounded error codes to structured errors) #54) are normal product/design issues, even if their output helps humans debug CI failures.

Done-when

• Release verification no longer duplicates the integration/unit/check logic already owned by CI/Extended Verification.
• Shared workflow units cover the recurring verification jobs without making the wrappers harder to understand.
• Manual/lab dispatches can run targeted platform/test/RouterOS combinations needed for Windows and cross-platform troubleshooting.
• Integration runs can optionally emit useful byproduct stats/artifacts without changing pass/fail behavior or doubling runtime.
• .github/instructions/ci.instructions.md matches the implemented workflow shape.

Follow-up from #22 item D, expanded after reviewing the open CI/testing issue cluster.