ci: Split build workflow into domain checks

[timflannagan]

Problem

.github/workflows/build.yaml currently owns several unrelated CI domains in
one sequential test job:

• Node setup, UI dependency installation, UI unit tests, and the UI build.
• Go setup and module caching.
• Docker environment startup.
• The full Go integration test suite.
• CLI subprocess E2E tests.

This makes the check difficult to reason about and expensive to rerun. A
failure in one domain prevents later domains from reporting independently, the
generic test check does not identify its owner, and every run provisions
toolchains and services that individual domains do not need.

The repository already separates lint, generated-code verification, Helm
tests, and Kubernetes E2E into domain-specific workflows. Build and test
coverage should follow the same ownership model.

Proposed Direction

Split build.yaml into independently reported workflows or jobs with clear
domain ownership. At minimum, separate:

• UI unit tests and production build.
• Go tests that require PostgreSQL.
• CLI subprocess E2E tests.

Each domain should install only the toolchain and services it needs. Preserve
the current push, pull_request, and merge_group behavior so merge queue
coverage does not regress. Shared setup should use a reusable action or
workflow only where it materially reduces duplication.

The initial change should preserve existing coverage. Optimizing the test
commands or changing their semantics can be evaluated separately after the
boundaries are clear.

Acceptance Criteria

• UI tests and make build-ui report under a UI-owned check without starting
  PostgreSQL or installing unnecessary Go test dependencies.
• make test reports under a Go/database-owned check with an explicit
  PostgreSQL dependency.
• make test-cli-e2e reports under a CLI-owned check and retains its database
  coverage.
• A failure in one domain does not prevent the other domains from running and
  reporting their own result.
• Push, pull request, and merge-group trigger coverage is preserved.
• Required-check and branch-protection configuration is updated if check names
  change.
• The monolithic build.yaml job is removed once equivalent independent
  checks are active.
• Workflow path filters, if introduced, are compatible with required checks
  and merge queue behavior.
• Existing CI coverage is not silently dropped during the split.

Additional Notes

Audit workflow self-paths while making this change. For example,
chart-tests.yaml currently filters on .github/workflows/chart-tests.yml,
which does not match the workflow's actual .yaml filename.