* Run CI in parallel lanes picked from the files a PR changes

CI took about 27 minutes because one Windows job ran every step in order,
and the Linux job repeated analyze, tests, and the Rust tests. Now analyze,
two test shards, and the web build run on Linux for every change, in
parallel. The Convex, presence, client-contract, Rust bridge, and desktop
build lanes run only when a PR touches their files. Pushes, PRs into main,
and PRs that change CI still run every lane. A newer push to a PR cancels
its older run, and the desktop builds cache cargokit's compiled Rust
dependencies.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Turn off setup-dart's problem matcher inside the setup action

It registers a matcher file relative to the calling action's folder, which
does not exist in a composite action, and failed every Flutter job.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Gate desktop releases on the upgrade test and narrow CI's desktop lane

The upgrade and rollback test only ran in CI, against an unsigned build of a
PR. The release itself never ran it, so the installer players download was
never checked. It now runs in the release on the signed installer, after the
signatures are verified and before anything is staged or published.

With the release as the gate, CI builds the desktop app and runs the test
only for PRs that touch Hive (migrations, generated adapters), the installer,
the release scripts, or the test itself, and no longer after every merge.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Run the Convex lane when its contract scripts change

The snapshot and audit scripts in tool/ run only in the Convex lane, against
its fresh preview, so a PR changing just those scripts skipped the checks
they define.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>