fix(ci): restore branch-scoped fallback rules

Problem

Commit d402a44d0 (refactor(ci): centralize branch filtering at workflow level) replaced per-job conditional fallbacks:

# Before (correct)
- if: "$CI_PIPELINE_SOURCE == \"merge_request_event\""
  changes: [...]
  when: on_success
- if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
  when: on_success

with bare catch-alls:

# After (broken)
- when: on_success  # matches EVERYTHING — all jobs run on every MR

workflow: controls which branches trigger pipelines — but it does not filter which jobs run inside those pipelines. The bare when: on_success matched all pipelines, so every lint/test job ran on every MR regardless of changed files.

Fix

1. Restore branch-scoped fallbacks (12 jobs)

Replace bare - when: on_success with:

- if: "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ /^release\/*/"
  when: on_success

2. Add explicit when: on_success to MR rules (9 jobs)

Refactor removed explicit when: from some MR rules. GitLab defaults to on_success, so no behavior change — just consistency.

3. Fix pre-existing gap: release/* branches had 0 jobs

Workflow allowed release/* pipelines (7283bebf3), but per-job rules only matched main. Release pipelines ran but executed no jobs. Now fixed.

Pipeline scope after fix

Pipeline source	Jobs that run
MR (changes match component)	Component lint + test only
MR (changes = .gitlab-ci.yml)	All jobs (validation complète)
main push	All jobs
release/* push	All jobs
Schedule	Scheduled jobs only
Tag	No lint/test (by design)