feat(ci): self-synced internal refs + PR pipeline self-test

[gmaclennan]

Fixes the workflow-versioning problem that made validating harness changes painful (temporary action-ref pin commits, manual test.yml dispatches — see the validation notes on #9).

1. Self-synced internal references

The composite action was pinned @main inside the reusable workflows (a relative uses: would resolve against the caller's checkout, hence the pin). That decouples the action version from the workflow version: @v2 callers run v2 workflows with main's action, and branch dispatches of test.yml silently run main's action instead of the branch's — which is why validating #9 required temporary commits pointing the ref at the branch.

The reusable workflows now check out this repo at job.workflow_sha — the documented context property that, for a job defined in a reusable workflow, is the commit SHA of the reusable workflow file itself (i.e. whatever the caller's @v2/@main/branch ref resolved to) — and use the action/harness from that checkout:

- uses: actions/checkout@v6
  with:
    repository: ${{ job.workflow_repository }}
    ref: ${{ job.workflow_sha }}
    path: .nodejs-mobile-bare-prebuilds
- uses: ./.nodejs-mobile-bare-prebuilds/.github/actions/prebuild

Workflow, action, and test harness now always travel together at one SHA. harness_ref stays as an optional override (default now self-sync instead of main), and test.yml no longer needs to thread github.sha through. This also resolves the earlier "fix reference pinning" / revert churn — there is no longer anything to pin.

2. PR pipeline self-test (ci.yml)

Every PR touching .github/** or test-harness/** now runs the real pipeline — prebuild (android-x64, quickbit-native@latest) → emulator test, including the floor-API-24 emulator from #9. Combined with (1), the PR's in-flight changes are what actually execute, so changes like #9 get validated automatically with no manual dispatch.

This PR validates itself: the ci.yml run on this very PR exercises the self-synced checkout path end-to-end.

Android-only by design (the cheap leg, and where toolchain regressions live); test.yml remains for manual iOS runs.

🤖 Generated with Claude Code

[gmaclennan]

Pushed three additions following review:

• move-major-tag.yml: pushing any vX.Y.Z tag (or gh release create) now force-moves the floating vX tag automatically — releasing becomes "push a semver tag", and @v2 callers follow with no changes. Addresses the rollout gap flagged in review (v2 currently sits at v2.1.2, pre-fix(android): target API 24 so prebuilds load on Android < 9 #9).
• README "Versioning and releasing" section: documents the major-tag contract, the self-synced internal refs (and the rule: never @<ref>-reference the composite action from inside this repo), and the release steps. None of this was previously written down.
• test.yml fix: a dispatched test_script was silently ignored because test_runner stayed smoke (it's only read for custom) — the run passed without executing the script. Now derived: non-empty test_script → test_runner: custom.

Plus review nits in the previous commit: permissions: contents: read on ci.yml, CI module pinned to quickbit-native@2.4.8, persist-credentials: false on the harness checkouts.

After merging: tag v2.2.0 to move v2 forward — the merged #9 floor-API test matrix and these changes only reach @v2 callers once the tag moves.

🤖 Generated with Claude Code