Regular push/PR runs the test job only. workflow_dispatch and v* tags
then build linux-amd64, windows-amd64, and macos-arm64 as separate
jobs. Windows is cargo-xwin from Ubuntu (MSVC ABI, Unix-host protoc)
instead of native windows-latest. Registry/git cache is shared on
Ubuntu; release target/ is not cached; xwin splat has its own cache.
