ci: reduce redundant Actions usage

[PanQiWei]

What this changes

Reduce duplicate and high-cost GitHub Actions execution while preserving required validation:

• run ccm-ci and installer-portability push events only on main
• cancel superseded pull-request revisions for ordinary CI
• gate live arm64/x64 macOS qualification behind ci:macos-live
• retain macOS evidence for 7 days and release transfer artifacts for 14 days
• document and contract-test the maintainer workflow

Verification

• 22 targeted workflow/content contract tests pass
• related release/licensing/required-check tests pass (5/5)
• tests/scripts/test_macos_evidence_artifact.sh passes
• actionlint passes for all four changed workflows
• bash scripts/check-plugin-dist-sync.sh passes
• claude plugin validate plugin/dist/claude-code passes
• full run-tests.sh: the 12-minute local run reproduced the pre-existing two test_codex-reinject.sh failures, then timed out in the long hook suite; no workflow-related regression appeared

Design invariants

No plugin runtime, board model, skill boundary, hook implementation, or distributed adapter semantics changed.

Notes for reviewers

This PR changes the macOS qualification workflow itself, so apply ci:macos-live once to validate the opt-in path against this exact PR head revision.