Rework CI: cross Windows on Linux, build only on dispatch/tag

Regular push/PR runs the test job only. workflow_dispatch and v* tags
then build linux-amd64, windows-amd64, and macos-arm64 as separate
jobs. Windows is cargo-xwin from Ubuntu (MSVC ABI, Unix-host protoc)
instead of native windows-latest. Registry/git cache is shared on
Ubuntu; release target/ is not cached; xwin splat has its own cache.

scripts/ci-package.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Copy a cargo --target release binary into dist/ with a checksum sidecar.
+#
+# Required env:
+#   TARGET    rustc triple (selects work/target/$TARGET/release/)
+#   ARTIFACT  basename without extension (grok-linux-amd64, …)
+#   EXE       filename cargo wrote (xai-grok-pager or xai-grok-pager.exe)
+
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+: "${TARGET:?TARGET is required}"
+: "${ARTIFACT:?ARTIFACT is required}"
+: "${EXE:?EXE is required}"
+
+src="$WORK_DIR/target/$TARGET/release/$EXE"
+[[ -f "$src" ]] || {
+  echo "missing $src" >&2
+  ls -la "$WORK_DIR/target/$TARGET/release" >&2 || true
+  exit 1
+}
+
+mkdir -p "$ROOT/dist"
+if [[ "$EXE" == *.exe ]]; then
+  dest="$ROOT/dist/${ARTIFACT}.exe"
+else
+  dest="$ROOT/dist/${ARTIFACT}"
+  strip "$src" || true
+fi
+cp "$src" "$dest"
+
+{
+  echo "artifact=$(basename "$dest")"
+  echo "target=${TARGET}"
+  echo "git=${GITHUB_SHA:-}"
+  echo "upstream=$(read_rev)"
+  echo "rustc=$(rustc --version)"
+} > "$ROOT/dist/${ARTIFACT}.txt"
+
+if command -v sha256sum >/dev/null; then
+  (cd "$ROOT/dist" && sha256sum "$(basename "$dest")" "${ARTIFACT}.txt" > "${ARTIFACT}.sha256")
+else
+  (cd "$ROOT/dist" && shasum -a 256 "$(basename "$dest")" "${ARTIFACT}.txt" > "${ARTIFACT}.sha256")
+fi
+
+info "packaged $dest"