CI: run the full heavy lane on long-lived branches by workflow_dispatch, without moving main's state #1787

The heavy CI workers (the ASan and TSan suites, macOS, valgrind, the bench gate, extensions, db) are gated github.event_name != 'pull_request'. They run only in the merge queue and on pushes to main. A long-lived integration branch therefore never gets them before it enters the queue. The R1.1 critic on #1776 (Phase 2) found that those lanes had never run on that branch. PR #1785 adds workflow_dispatch to ci.yml.

Done when

• gh workflow run ci.yml --ref <branch> runs every heavy worker on that branch, as a push to main would.
• ci-main (the rolling image fork PRs run in) advances ONLY on a push to main whose SHA is main's current tip. Neither a dispatch from any ref nor a re-run of an older main push run moves it. A property check proves this: the tag computation, run across a matrix of event × ref × tip, emits ci-main only on push + refs/heads/main + tip. It fires once, with plants recorded in the PR (PRINCIPLES §5).
• Jobs that hold write credentials use only reviewed actions, and no local ./ actions. ci.yml references no secret other than GITHUB_TOKEN.
• On a dispatch, the bench gate measures against the branch's merge-base with main, as the queue does, not against main's tip.
• A dispatch cannot change main's README badge, and a cancelled dispatch's aggregator failures are documented, or prevented.
• docs/CI.md states exactly what a dispatch runs and writes, where its results show, and how concurrency behaves.

Generated by Claude Code