CI: gate SLOTHY and add label to trigger it

.github/workflows/slothy.yml

@@ -8,11 +8,63 @@ permissions:
 on:
   workflow_call:
   workflow_dispatch:
+  push:
+    branches: ["main"]
+  # Standalone trigger so SLOTHY can be requested on an existing PR by adding
+  # the `slothy-tests` label. Adding `labeled` to all.yml instead would re-run
+  # all of CI on every label change.
+  pull_request:
+    branches: ["main"]
+    types: [ "labeled" ]
 
 jobs:
+  # Coarse gate so the EC2 instance only starts when the SLOTHY
+  # inputs or toolchain are changed.
+  check_modified_files:
+    name: Determine changed files
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork
+    outputs:
+      # The `slothy-tests` label is the manual override for changes the file
+      # filter below cannot see, e.g. a toolchain regression to reproduce.
+      # Pushes to main always run SLOTHY.
+      # A `labeled` event is only ever a request for SLOTHY itself, so adding
+      # an unrelated label must not start an EC2 instance; other PR events
+      # fall back to the file filter.
+      run_needed: >-
+        ${{ github.event_name == 'push' ||
+        (github.event.action == 'labeled' && github.event.label.name == 'slothy-tests') ||
+        (github.event.action != 'labeled' &&
+        (steps.changed-files.outputs.any_changed == 'true' ||
+        github.event_name == 'workflow_dispatch' ||
+        contains(github.event.pull_request.labels.*.name, 'slothy-tests'))) }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        if: github.event_name != 'workflow_dispatch' && github.event.action != 'labeled'
+        with:
+          # Enough history for changed-files (rebase-merge pushes can be multi-commit)
+          fetch-depth: 100
+      - name: Get changed files
+        id: changed-files
+        if: github.event_name != 'workflow_dispatch' && github.event.action != 'labeled'
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
+        with:
+          files: |
+            .github/workflows/slothy.yml
+            .github/workflows/ci_ec2_reusable.yml
+            scripts/autogen
+            dev/aarch64_clean/**
+            dev/aarch64_opt/**
+            dev/fips202/aarch64/**
+            mldsa/src/native/aarch64/**
+            mldsa/src/fips202/native/aarch64/**
+            flake.nix
+            flake.lock
+            nix/**
   slothy:
     name: SLOTHY
-    if: ${{ github.repository_owner == 'pq-code-package' && !github.event.pull_request.head.repo.fork }}
+    needs: [ check_modified_files ]
+    if: needs.check_modified_files.outputs.run_needed == 'true'
     permissions:
       contents: 'read'
       id-token: 'write'