feat(ci): upload crossref-tags baseline artifact on every build

The orchestrator that posts the PR comment used to render every
cross-reference tag in any file the PR touched. A maintenance PR that
touches a thousand files (without changing tags) would still fire on
hundreds of unchanged tags. The right semantics is to subtract tags
that already existed at the PR's merge-base commit.

This change unconditionally uploads the dump output as a plain
`crossref-tags-baseline` artifact (5-day retention, ~55 KB). The
privileged workflow_run job (crossref_review.yml + mathlib-ci's
post-comment.sh) looks up the PR's merge-base SHA via the GitHub
compare API, downloads the matching master baseline, and passes it to
crossref-render via `--baseline-tsv`. Only rows that don't match a
baseline row verbatim are rendered.

PR runs still also emit the privileged `crossref-tags-bridge` artifact
for the workflow_run consumer; non-PR (master / bors / staging) runs
only upload the plain baseline.

Cost: ~2 seconds per non-PR build to run the dump (cached Mathlib build
is already loaded).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: kim-em

.github/workflows/build_template.yml

@@ -745,17 +745,26 @@ jobs:
       - name: clean up the import graph file
         run: rm import_graph.dot
 
-      # PR-only: this only feeds crossref_review.yml's PR comment.
-      # See scripts/dump_crossref_tags.lean for the output format and the
-      # (defence-in-depth) size cap; the trusted bound is in mathlib-ci's
-      # post-comment.sh.
+      # Always-on: produce the TSV for every build (PR + push to master).
+      # Master pushes upload it as a plain artifact (`crossref-tags-baseline`)
+      # so that workflow_run jobs on PRs can subtract the merge-base baseline
+      # and only render tags this PR actually changed.
+      # PR runs additionally emit a privileged bridge artifact for
+      # `crossref_review.yml` to consume.
+      # See scripts/dump_crossref_tags.lean for the output format.
       - name: dump cross-reference tags to TSV
-        if: github.event.pull_request.number != ''
         run: lake env lean --run scripts/dump_crossref_tags.lean crossref-tags.tsv
 
+      - name: upload crossref-tags baseline artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: crossref-tags-baseline
+          path: crossref-tags.tsv
+          retention-days: 5
+
       - name: prepare crossref bridge outputs
-        # We only emit the crossref bridge artifact when this build is for a PR
-        # (the `crossref_review.yml` workflow_run job has nothing to post otherwise).
+        # The privileged crossref_review.yml workflow_run job only fires
+        # for PRs; non-PR builds don't need the bridge artifact.
         id: crossref_outputs
         env:
           EVENT_NAME: ${{ github.event_name }}