refactor(landlock-run): unify workspace release (review round 1)

.github/workflows/landlock-run.yml

@@ -1,15 +1,27 @@
-# Manually-dispatched CI for the landlock-run source of record
-# (native/landlock-run). A separate workflow from ci.yml on purpose: the
-# subtree is a self-contained pnpm workspace with its own gates, exercised on
-# demand — per-architecture native legs (build + behavioral tests + pack
-# rehearsal on real kernels) plus one darwin leg proving the documented
-# degradation on hosts without a platform package. Legs derive from the
-# subtree's checked-in package matrix (scripts/github-matrix.mjs). Packing
-# for npm happens in the release mirror (node-addon-landlock-run) after an
-# export — see native/README.md; this workflow never packs for release.
+# CI for the landlock-run packages under native/landlock-run. A separate
+# workflow from ci.yml keeps the native OS/architecture matrix independent of
+# the harness Node matrix. Release assembly and publication use the companion
+# Landlock Run Release workflow.
 name: Landlock Run
 
 on:
+  pull_request:
+    paths:
+      - '.github/workflows/landlock-run.yml'
+      - '.github/workflows/landlock-run-release.yml'
+      - 'native/landlock-run/**'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+  push:
+    branches: [master]
+    paths:
+      - '.github/workflows/landlock-run.yml'
+      - '.github/workflows/landlock-run-release.yml'
+      - 'native/landlock-run/**'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
   workflow_dispatch:
 
 concurrency:
@@ -52,16 +64,16 @@ jobs:
 
       - uses: pnpm/action-setup@v4
         with:
-          package_json_file: native/landlock-run/package.json
+          package_json_file: package.json
 
       - uses: actions/setup-node@v4
         with:
           node-version: 24
           cache: pnpm
-          cache-dependency-path: native/landlock-run/pnpm-lock.yaml
+          cache-dependency-path: pnpm-lock.yaml
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --filter node-addon-landlock-run-workspace... --frozen-lockfile
 
       - name: Install musl toolchain
         run: |
@@ -103,16 +115,16 @@ jobs:
 
       - uses: pnpm/action-setup@v4
         with:
-          package_json_file: native/landlock-run/package.json
+          package_json_file: package.json
 
       - uses: actions/setup-node@v4
         with:
           node-version: 24
           cache: pnpm
-          cache-dependency-path: native/landlock-run/pnpm-lock.yaml
+          cache-dependency-path: pnpm-lock.yaml
 
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --filter node-addon-landlock-run-workspace... --frozen-lockfile
 
       - name: Build TypeScript
         run: pnpm build:ts