CI workflows and local checks

No workflow builds or tests a pull request. The pr.yml workflow gated every pull request to main until the gate-reduction task deleted it: the classify job (the path classifier) and pr-gate (the sole required check, which aggregated classify) went with it, and the branch-protection required check was removed. The site check it once ran now runs locally (see the fate table below).

Five workflows still run on pull_request. The first four each fire only on their own paths and cover drift and lint alone:

• codegen-drift.yml (projects/*/modeling/**, projects/ores.codegen/**) runs check_component_drift.py --all and check_model_drift.py --summary. It guards a gap template-drift.yml cannot see: that job proves the .mustache artefacts match their org sources, not that the code generated from them was regenerated afterwards.
• doc-lint.yml (**.org, **.mustache, build/scripts/generate_skill*.py, compass.py, and itself) runs compass lint plus the six skill-consistency checks.
• shell-script-drift.yml (doc/recipes/shell/**, the recipe script builder, projects/ores.shell/scripts/library/**) re-runs the shell tangle and fails on a diff.
• template-drift.yml (projects/ores.codegen/library/templates/** and the tangle script) re-runs the template tangle and fails on a diff.
• claude.yml runs the review on demand via an @claude comment.

A change matching none of those paths sees no CI at all, which is why the submit-PR skill's local classification stays mandatory: it is the only thing that catches a broken build before review.

The submit-PR skill classifies the diff and runs only the matching checks. The classes mirror the retired pr.yml classifier's buckets, with one addition (python tooling):

A mixed change runs the union of its classes' checks.

The python tooling class exists because the retired classifier bucketed ores.compass and ores.codegen changes as docs, so their test suites never ran anywhere; locally they always do.

The projects/*/modeling/* paths under docs carry a codegen-drift exception — to this table's default, not to CI: codegen-drift.yml does gate them on a PR. The exception exists because a model-only edit classifies as docs, and the docs class on its own runs no codegen check. A change touching the modeling paths therefore also runs the codegen drift checks (tangle, then check_component_drift.py). Run them locally even though CI repeats them: the gate only reports after a reviewer is already looking.

1. Classify the diff with the rule table.
2. Run the checks for the class (site build, or compass build + compass test run).
3. Submit the build to CDash as experimental for visibility (./compass.sh test run --preset <preset> --cdash Experimental; runs the CTest.cmake script under the build lock, same shape CI uses).
4. Run the review skill locally (compass-code-review-pr, including the misspell check); record findings in the task's * Review table; address them.
5. Record the verification in the PR description as a --change bullet (e.g. "Verification: doc-only change; local site build clean").
6. Raise the PR. The four drift/lint workflows run their own checks on the paths they cover, and the on-demand @claude trigger stays. Nothing on GitHub builds or tests the PR. Merge when the review round is complete. Continuous builds and nightlies stay on GitHub.

• How experimental submissions are tagged and filtered out of the continuous/nightly dashboards on CDash.
• Which exact test suites run for python tooling changes (compass, codegen).