ci: make per-package test matrix respect detect-changes

[OttoAllmendinger]

Problem

Every Test <package> job ran on every PR, regardless of what changed. A PR touching only packages/wasm-utxo/ still ran Test wasm-privacy-coin (and all 6 other package jobs).

Root cause: the test job's matrix used a dynamic base (package: ${{ fromJson(detect-changes) }}) plus a static include: block listing all 7 packages with their per-package flags. GitHub Actions spawns a new matrix combination for any include: entry whose package can't merge into the base (it would overwrite package), so the include block re-added every package as its own job — defeating detect-changes.

Evidence: for PR #306 (head 8feac80a, only packages/wasm-utxo/ files), Detect Changes logged Packages to test: ["wasm-utxo"], yet all 7 Test * jobs ran.

Fix

• Move the per-package flags (needs-wasm-pack, has-wasm-pack-tests) into .github/scripts/detect-changes.mjs, which now emits an array of objects [{package, needs-wasm-pack, has-wasm-pack-tests}] filtered to changed packages.
• Consume it with matrix.include: ${{ fromJson(needs.detect-changes.outputs.packages) }} — no base package: key, no static list.

Now only changed packages become test jobs. The non-PR / shared-infra (.github/, root package.json/lerna.json/package-lock.json) / no-op fallbacks still return all packages, so the matrix is never empty on PRs.

Verification

Locally simulated the PR #306 scenario (BASE_SHA=c744b64d HEAD_SHA=8feac80a):

Packages to test: [{"package":"wasm-utxo","needs-wasm-pack":true,"has-wasm-pack-tests":true}]

→ matrix would spawn only Test wasm-utxo instead of all 7. prettier clean. (actionlint not run locally — nix unavailable; the repo's CI flake check validates it.)

Notes

• The stable test / Test gate job (needs: [build, test, finalize]) remains the branch-protection check; per-package jobs are not required to run individually.
• The build job still builds all packages unconditionally (it produces one shared build-output artifact); this change only scopes the per-package test jobs. Making build per-package is a larger refactor, intentionally out of scope.
• No ticket — discovered while investigating PR feat(wasm-utxo): expose requiresPrevTx prevTx-inclusion policy #306.