Dedupe CI into a reusable workflow_call (PR gate + release tag gate)

[Zlyzart]

Summary

#60 duplicates the full test surface from ci-complete.yml into release.yml (a tag push bypasses the PR gate, so it has to re-run the gate standalone). That duplication will drift. Extract the shared jobs into a reusable workflow (workflow_call) consumed by both.

Scope

• New: .github/workflows/ci-reusable.yml exposing the test surface (fmt, clippy -D warnings, cargo-machete, cargo test --workspace, frontend Biome/Vitest/Playwright, desktop clippy + test) via on: workflow_call.
• Refactor ci-complete.yml to call it (preserving the changes path-filter skips, gate-integrity, secret-scan, and the CI complete aggregator behavior that branch protection depends on).
• Refactor release.yml (from Release pipeline (unsigned): tag-triggered test gate → auto-file failure issue or publish Windows release #60) to call the same reusable workflow for its test job.

Acceptance criteria

• Both PR CI and the release tag gate invoke the same workflow_call workflow — no duplicated step lists.
• The CI complete required check name and pass-on-skip semantics are unchanged (branch protection keeps working).
• Gate guard stays green (editing gate machinery requires owner approval — expect it to flag).

Notes

Blocked on #60 landing (the duplication this repays). Watch the gate-guard: touching ci-complete.yml job structure will be flagged and needs an owner review to clear.

Depends on #60.