fix(ci): use find as single source of truth for framework project detection

[mikemaccana-edwardbot]

The bug

Each framework workflow (anchor.yml, native.yml, pinocchio.yml, quasar.yml, solana-asm.yml) had two competing answers to "which projects are build targets":

1. workflow_dispatch / schedule: find . -type d -name <framework> — exact directory-name match. ✅
2. pull_request / push: a substring pipeline:

   dirname "$file" | grep <framework> | sed 's#/<framework>/.*#/<framework>#g'

   substring match. ❌

The substring path let ghost paths leak into the build list. For example, on PR #16 a change to:

tokens/nft-meta-data-pointer/anchor-example/app/pages/api/...

was matched by grep anchor (substring of "anchor-example") and was not collapsed by sed 's#/anchor/.*#/anchor#g' because the path contains no literal /anchor/ segment. The ghost path then entered the candidate list, pnpm install ran in a directory with no package.json, and CI went red.

The fix

Single source of truth. Every workflow now uses one function — get_projects() — which calls find . -type d -name <framework>. The PR/push paths intersect that authoritative list with the changed files via a prefix match (<project>/):

function filter_by_changes() {
  local all_projects="$1"
  shift
  local changed_files=("$@")
  echo "$all_projects" | while read -r project; do
    [ -z "$project" ] && continue
    local project_prefix="${project#./}/"
    for file in "${changed_files[@]}"; do
      if [[ "$file" == "$project_prefix"* ]]; then
        echo "$project"
        break
      fi
    done
  done | sort -u
}

Key properties:

• One source of truth: find -type d -name <framework>.
• Impossible by construction: a path cannot enter the build list unless find returned it. No more substring matching, no more sed games — ghost siblings like anchor-example/, wasm/, plasma/, pinocchio-example/ cannot leak in.
• .ghaignore filter is applied to the find output before the intersection.
• Behaviour preserved for workflow_dispatch, schedule, and workflow-file-changed events (those paths already called get_projects() directly). Empty changed_files on push still falls through to all projects.

What changed

5 files, all in .github/workflows/:

• anchor.yml
• native.yml
• pinocchio.yml
• quasar.yml
• solana-asm.yml

Each gained a filter_by_changes() helper and dropped the grep | sed | awk substring pipeline from both the push branch and the pull_request branch.

Expected CI state after merge

This PR fixes the project-detection logic. It does not fix any project's actual build/test failures. So:

Trigger	Expected CI
Normal PR or push touching a healthy project's files	✅ Green
Normal PR or push touching a currently-broken project's files (e.g. any tokens/**/quasar or block-list/pinocchio)	❌ Red — the project itself doesn't build
Workflow-file change, scheduled run, or workflow_dispatch	❌ Red — full matrix runs every project, exposes pre-existing failures
This PR's own CI (touches workflow files → full matrix)	❌ Red — exposes the pre-existing failures listed below

The PR is "ready to merge" in the sense that the logic change is correct and self-contained; the red CI on this PR is exposing failures that exist on main today, not failures this PR introduces.

Pre-existing failures this exposes

Tracked separately, not in scope for this PR:

• tokens/**/quasar (27 projects) — upstream quasar-spl (git master) has duplicate definitions for delegate / close_authority / mint_authority / freeze_authority in src/token.rs, causing error[E0592] on every consumer. Fixed in parallel by pinning quasar-spl to a working revision (separate PR — link to follow).
• tokens/token-extensions/transfer-hook/block-list/pinocchio — WIP port from pblock-list with no pnpm-lock.yaml, no tests/, no build script. Either needs to be finished properly or removed from the tree (separate PR).

What is now impossible: a non-project path entering the matrix at all.