docs(ci): describe CI as the job set behind the rollup check (RIG-5280)

[rigel-mintaka]

This PR is part of a stack containing 3 PRs:

1. main
2. test(e2e): embedded-postgres smoke leg and WithEmbeddedPostgres (RIG-2906) #2211
3. docs(testing): document the Go testing tiers (RIG-2908) #2221
4. "docs(ci): describe CI as the job set behind the rollup check (RIG-5280)" (this PR)

What

The ## CI section of docs/architecture/build-and-ci.md described one CI job, with the real-Postgres suites as a step in it. ci.yml is now a set of jobs behind one required rollup check. The section now describes:

• setup and tools/ci-matrix (moon's affected set plus changed-paths flags);
• the moon (<group>) legs;
• the special jobs, flag-gated on PRs except e2e, and always run on main and nightly;
• the pgtest and e2e commands, and COMPASS_REQUIRE_LIVE;
• the "ran rather than skipped" guards;
• bun-audit;
• the affected-vs-full rule;
• the design-ledger-gate injection.

Other sentences that still assumed one job or moon ci are fixed:

• Task graph: CI uses setup + moon run <targets>, not moon ci.
• What CI does not gate: the gtk4 and microvm jobs.
• The unified release lane: the "ONE-JOB doctrine" line is restated as the rule that still holds, that no workflow lists moon projects.
• Pre-merge build check: setup selects affected projects; the image build runs in the moon (nix) leg behind rollup; the 90m is the moon job's timeout.

testing-tiers.md links back here for CI jobs. The inbound #publishing-the-agent-image anchor is unchanged.

Stacked on #2221.

Verification

• Each claim was checked against .github/workflows/ci.yml and pr-base-repoint.yml in three review rounds.
• rumdl check: clean. eng-docs gather tests: 141 pass.

Spec-impact: none
Ledger-impact: none

Closes RIG-5280

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-5280

[rigel-mintaka]

Review at head 0d5a9c43: high 0, medium 0, low 0, nit 0

• Scope: the whole PR, all lenses, 3 rounds. Each claim was checked against ci.yml and pr-base-repoint.yml. Round 1 found 1 high (e2e is not flag-gated; it runs on every PR), 3 medium (stale one-job and moon ci lines in the Task graph, release lane and Pre-merge build check sections) and 7 low. All folded.
• Round 2 found 1 medium: the base-move re-run is automatic, not by hand. Folded, along with wrapping. Round 3 found 1 cosmetic low, folded.
• Checks: rumdl is clean. The eng-docs gather tests pass (141). The #publishing-the-agent-image anchor is intact.

[github-actions]

Compass engineering docs preview: https://compass-comms-rig-5280-build.compass-eng-docs.pages.dev

Deployed from compass-comms/rig-5280-build-ci-doc at 0d5a9c4.

Changed pages:

• docs/architecture/build-and-ci.md
• docs/architecture/testing-tiers.md