ci(scripts): 收敛 CI 脚本门禁与工具闭包

[iamsyc]

变更

• 拆分 scripts/ci/static.sh 为 shell、workflow、project 三段静态门禁。
• 将 bootstrap profile 的工具闭包集中到 scripts/dev/bootstrap_profiles.sh。
• 固定 PR 基础门禁为 static、unit、xcode build，分类规则只控制 dependency review、UI smoke、release smoke。
• 补齐 CI 脚本、doctor、bootstrap profile 之间的间接工具依赖校验。

验证

• ROOT_DIR="$(pwd)" TOOL_ROOT="$(pwd)" scripts/ci/static.sh
• ROOT_DIR="$(pwd)" TOOL_ROOT="$(pwd)" scripts/ci/unit.sh --out-dir .ai-tmp/pr75-unit
• ROOT_DIR="$(pwd)" TOOL_ROOT="$(pwd)" scripts/ci/xcode.sh --action build --configuration Debug --out-dir .ai-tmp/pr75-xcode-build
• ROOT_DIR="$(pwd)" TOOL_ROOT="$(pwd)" scripts/ci/release_smoke.sh --arch arm64 --label arm64 --out-dir .ai-tmp/pr75-release-smoke
• git diff --check

[github-actions]

CI Summary

Run: Open

Check	Status	Details
Change Scope	code	code=true ui=false script=true product=false test=false ci=true release=true dependency=false tooling=false docs_only=false unknown=false
Required Gates	derived	static=true dependency=false unit=true xcode=true ui=false release=true PRs always run static, unit, and xcode build gates.
Dependency Review	skipped	required=false high and critical vulnerabilities block
Static Checks	success	required=true actionlint, shellcheck, shfmt, SwiftFormat, SwiftLint, action pinning
Unit Tests	success	required=true Swift tests: 552 Go packages: 2 Reason: passed Artifact: unit-gate
Xcode Build	success	required=true Debug build with zero warning scan Artifact: xcode-build
UI Smoke	skipped	required=false Failure classification is written by ui-smoke-summary.json in each artifact. Artifacts: ui-smoke-baseline, ui-smoke-permissionDenied, ui-smoke-rebuildFailed
Release Smoke	success	required=true arm64=success intel64=skipped PR release smoke requires arm64 only. Artifacts: release-smoke-arm64 Release verify summaries are produced by release.yml before publishing.
Artifacts	link	Open artifacts
CI Gate	success	single branch protection check