Extend CI with cross-platform build lanes and hardening

[physicsG]

Summary

Follow up on #7 by extending the now-working Linux CI/testing pipeline with cross-platform compile coverage, stricter validation for new multiACE code, and repository-level enforcement.

Context

Issue #7 delivered the initial pull-request CI pipeline:

• changed-file formatting and repository hygiene checks;
• pinned workflow/YAML/Markdown/JSON validation;
• cached Linux dependency and compiler builds;
• CMake configuration and compilation;
• blocking Catch2/CTest baselines with explicit legacy quarantine;
• representative Linux build smoke;
• stable aggregate required check;
• least-privilege permissions and no release/signing access.

This issue tracks the remaining CI hardening that is useful but not required to consider the initial pipeline complete.

Scope

• Add Windows build-smoke coverage using the repository's existing reusable Windows build/dependency workflows where practical.
• Add macOS build-smoke coverage using the repository's existing reusable macOS build/dependency workflows where practical.
• Ensure changes under deps/** invalidate and rebuild the appropriate Linux, Windows, and macOS dependency caches.
• Split or expose stable check names for unit tests, integration tests, and platform build smoke where branch protection benefits from separate checks.
• Add warning-as-error or equivalent strict compiler validation for newly introduced multiACE/domain modules without making unrelated legacy warnings blocking.
• Keep fork pull requests read-only and unable to access signing, notarization, publishing, or release secrets.
• Configure or document branch-protection requirements around the stable aggregate required check.
• Re-enable additional blocking test groups as Add multiACE unit, integration, contract, and G-code test infrastructure #6 introduces tagged multiACE unit, integration, contract, 3MF, and G-code tests.

Acceptance criteria

• Linux, Windows, and macOS receive representative compile/build-smoke coverage.
• Dependency cache keys are platform-specific and invalidate when relevant dependency definitions change.
• New multiACE modules receive strict compiler and clang-tidy validation.
• Stable check names are available for branch protection, with required remaining the aggregate gate.
• Documentation-only changes avoid unnecessary platform builds.
• Fork pull requests cannot access signing or publication credentials.
• Test groups introduced by Add multiACE unit, integration, contract, and G-code test infrastructure #6 can be selected independently for fast PR, cross-platform, and nightly execution.
• The final workflow set has a confirmed green run on all enabled platforms.

Dependencies

• Builds on Add pull-request CI quality gates and automatic test execution #7.
• Test expansion depends on Add multiACE unit, integration, contract, and G-code test infrastructure #6.
• Release publication remains tracked separately by Add selectable cross-platform release build and publication workflow #8.

Design references

• doc/ci_cd_strategy.md
• doc/multiace_testing_strategy.md