ci(prepare-images): respect disable-build-* PR labels

[Fedr]

Summary

The prepare-images workflow rebuilt every Docker image whenever the relevant Dockerfile / requirements / vcpkg/** paths changed, ignoring any disable-build-<platform> PR labels. So a PR that legitimately disabled a platform still paid for that platform's image build (the slowest of which — the Windows vcpkg cache — is a 4-hour budget job).

This PR plumbs the existing build_enable_<platform> config outputs through to prepare-images and skips the matching cells / jobs. Live-label semantics from #6008 are inherited transparently — build_enable_* is already derived from gh pr view-fetched labels at job time, so adding/removing a disable-build-* label and re-running CI takes effect on the next run.

Label → skipped image build:

Label	Skipped cells
disable-build-ubuntu-x64	ubuntu22/x64, ubuntu24/x64
disable-build-ubuntu-arm64	ubuntu22/arm64, ubuntu24/arm64
disable-build-emscripten	emscripten/arm64
disable-build-linux-vcpkg	rockylinux8-vcpkg/{x64,arm64}
disable-build-windows	vs2019 + vs2022 vcpkg cache builds

Implementation:

• prepare-images.yml — five new boolean workflow_call inputs (disable_ubuntu_x64, disable_ubuntu_arm64, disable_emscripten, disable_linux_vcpkg, disable_windows), all defaulting to false so workflow_dispatch keeps building everything.
  • The two single-platform jobs (linux-vcpkg-build-upload, windows-vcpkg-build-upload) just AND !inputs.disable_<platform> into the existing rebuild-needed if:.
  • The linux-image-build-upload job needs per-cell skipping (drop ubuntu*/x64 cells while keeping ubuntu*/arm64 and emscripten/arm64). matrix context isn't available in job-level if: for reusable workflow inputs, so a small upstream compute-linux-image-matrix job emits a jq-filtered include list and the build job consumes it via matrix.include: ${{ fromJSON(...) }}. Matrix entries carry only {distro, arch} so the auto-generated cell name stays (<distro>, <arch>); runs-on and the image suffix are derived from matrix.arch inline.
• build-test-distribute.yml — wires the existing needs.config.outputs.build_enable_<platform> flags (negated, so enable=false → disable=true) into the new inputs. No new config outputs needed since build_enable_* already collapses tag-disable-<platform> and tag-update-doc-only.

Skipped matrix cells / jobs show as "Skipped" in the UI, and the called workflow remains a success() for downstream needs: consumers (the existing always-success job guarantees at least one cell).

Test plan

Verified end-to-end in sandbox PR #6030 (closed; HEAD preserved as tag wip/sandbox-test-disable-labels-pr-6030), which touched docker/ubuntu22Dockerfile + thirdparty/vcpkg/triplets/x64-linux-meshlib.cmake to force all three need_*_rebuild=true, with labels disable-build-{ubuntu-x64,windows,linux-vcpkg,macos} applied. Run 25277872552:

• disable-build-windows skips windows-vcpkg-build-upload (and disable-build-linux-vcpkg skips linux-vcpkg-build-upload) even when their need_*_rebuild is true — both observed skipped.
• disable-build-ubuntu-x64 drops ubuntu*/x64 cells while keeping ubuntu*/arm64 and emscripten/arm64 — compute-linux-image-matrix emitted exactly 3 cells ((ubuntu22, arm64), (ubuntu24, arm64), (emscripten, arm64)), no */x64 cells spawned. (emscripten, arm64) built green; the two ubuntu arm64 cells failed inside the Dockerfile on a transient Launchpad PPA timeout (add-apt-repository → api.launchpad.net), unrelated to this PR.
• No disable-build-* labels behaves identically to today — verified by inspection: all disable_* default to false, the jq filter then keeps all 5 cells, and the two single-platform jobs reduce to the master-baseline if: expression.
• workflow_dispatch keeps building everything — verified by inspection: every new input has default: false; no preexisting need_*_rebuild semantics change.