PRs now stop after bootstrap + tests. The per-march variant builds,
packaging, and upload-artifact steps reuse the same guard the rolling
'latest' tag/release steps already had, so artifacts are only produced
on push to master (or manual workflow_dispatch).