ci: clean up GitHub workflows

[datlechin]

What

Cleans up the .github workflows after a full audit. No dead files were found; the changes are a consolidation, a quarantine burn-down, and removal of two gates per maintainer decision.

Consolidation

• macos-tests.yml gains a workflow_call trigger.
• build.yml calls it instead of duplicating ~50 lines of lint/test. Same release gating, no copy-paste drift.

Quarantine burn-down (47 → 40)

Built for testing and ran all 47 quarantined suites headless. 7 now pass cleanly (165 tests, exit 0), so they rejoin the CI gate:
FilterSQLGeneratorTests, RowOperationsManagerBinaryCopyTests, ConnectionSharingTests, DBeaverImporterTests, ForeignAppImporterRegistryTests, CoordinatorColumnVisibilityTests, SidebarViewModelTests.

Removed gates

• Deleted contract-drift.yml and pluginkit-abi.yml.
• scripts/check-pluginkit-abi.sh, scripts/audit-refactor-health.sh, and duplicate-contract-baseline.txt stay as manual dev tools.
• Updated CLAUDE.md and a test comment so the ABI check is described as manual, not a CI gate.

Action required after merge

If branch protection lists PluginKit ABI Gate or Shared contract drift as required status checks, remove them, or PRs will block waiting on checks that no longer run. The abi-additive label is now orphaned and can be deleted.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 58dc4f5b64

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restrict release downloads to build artifacts

On tag builds this newly called reusable workflow uploads macos-test-results (TestResults.xcresult), and the release job later calls actions/download-artifact without a name/pattern; GitHub documents that omitting a name downloads all artifacts in the run (https://docs.github.com/en/actions/tutorials/store-and-share-data#downloading-artifacts-during-a-workflow-run). That means releases now pull the full xcresult bundle into artifacts-raw even though only artifacts-arm64/artifacts-x86_64 are needed, which can make release jobs slow or fail on large test logs; restrict the release download to artifacts-* or skip the test-results upload when invoked from build.yml.

Useful? React with 👍 / 👎.