tests: Overhauling CI infra

ci(test-dx): grant id-token: write at ci.yml top level

The reusable build jobs (build_linux/build_windows) request 'id-token: write'
for OIDC; a reusable workflow can't exceed its caller's permission ceiling, so
ci.yml's top-level 'contents: read' made GitHub reject it (startup_failure:
"nested job 'build' is requesting 'id-token: write', but is only allowed
'id-token: none'"). Grant id-token: write + contents: read, matching the
original per-platform entry workflows.

Author: narendasan

.github/workflows/_decide.yml

@@ -0,0 +1,62 @@
+name: _decide
+
+# Resolve the lane + backend from the triggering event. Shared by the
+# per-platform entry workflows (ci-linux-x86_64 / ci-windows / ci-sbsa) so the
+# rules live in exactly one place. `github.*` here refers to the caller's event.
+#
+#   lane:    fast (PR push) | full (approval / `ci: full` / main push) |
+#            nightly (schedule) | skip (non-approval review)
+#   backend: standard | rtx | both  — from the `backend: TensorRT[-RTX]` labels
+#            (or the workflow_dispatch `backend` input)
+
+on:
+  workflow_call:
+    outputs:
+      lane:
+        description: "fast | full | nightly | skip"
+        value: ${{ jobs.decide.outputs.lane }}
+      backend:
+        description: "standard | rtx | both"
+        value: ${{ jobs.decide.outputs.backend }}
+
+jobs:
+  decide:
+    runs-on: ubuntu-latest
+    outputs:
+      lane: ${{ steps.pick.outputs.lane }}
+      backend: ${{ steps.pick.outputs.backend }}
+    steps:
+      - id: pick
+        env:
+          EVENT: ${{ github.event_name }}
+          REVIEW_STATE: ${{ github.event.review.state }}
+          HAS_FULL_LABEL: "${{ contains(github.event.pull_request.labels.*.name, 'ci: full') }}"
+          # Exact array-element match: 'backend: TensorRT' != 'backend: TensorRT-RTX'.
+          HAS_RTX_LABEL: "${{ contains(github.event.pull_request.labels.*.name, 'backend: TensorRT-RTX') }}"
+          HAS_STD_LABEL: "${{ contains(github.event.pull_request.labels.*.name, 'backend: TensorRT') }}"
+          DISPATCH_LANE: ${{ github.event.inputs.lane }}
+          DISPATCH_BACKEND: ${{ github.event.inputs.backend }}
+        run: |
+          set -euo pipefail
+          case "$EVENT" in
+            schedule)           lane=nightly ;;
+            workflow_dispatch)  lane="${DISPATCH_LANE:-full}" ;;
+            push)               lane=full ;;                  # main canary
+            pull_request_review)
+              [ "$REVIEW_STATE" = "approved" ] && lane=full || lane=skip ;;
+            pull_request)
+              [ "$HAS_FULL_LABEL" = "true" ] && lane=full || lane=fast ;;
+            *)                  lane=fast ;;
+          esac
+          echo "lane=$lane" >> "$GITHUB_OUTPUT"
+          case "$EVENT" in
+            workflow_dispatch) backend="${DISPATCH_BACKEND:-both}" ;;
+            pull_request)
+              if   [ "$HAS_RTX_LABEL" = "true" ] && [ "$HAS_STD_LABEL" = "true" ]; then backend=both
+              elif [ "$HAS_RTX_LABEL" = "true" ]; then backend=rtx
+              elif [ "$HAS_STD_LABEL" = "true" ]; then backend=standard
+              else backend=standard; fi ;;
+            *)                  backend=both ;;   # push / approval / schedule
+          esac
+          echo "backend=$backend" >> "$GITHUB_OUTPUT"
+          echo "Resolved lane='$lane' backend='$backend' (event=$EVENT)."