Policy: status badges pin to the default branch; board sweeps are path-selected dispatches on main

[zackees]

Follow-up to #122. FastLED/fbuild adopted this after a CI storm jammed the fleet and its README badges showed platforms red that were actually green.

What went wrong

• Unfiltered badge.svg URLs reflect whatever run GitHub picks, including branch workflow_dispatch sweeps and month-old cancelled runs (a cancelled run renders as failing). GitHub serves cached badge images inconsistently, so the same badge flapped between passing and failing with no new runs. All 67 platform workflows were green on main.
• One branch dispatching the full per-board matrix started ~170 runs, each recompiling the tool, and saved ~150 GB-scale cache entries that evicted main's caches.

Policy

1. Badges: every workflow badge URL carries ?branch=<default> (e.g. badge.svg?branch=main). Do not add event=push when the workflow is dispatch/workflow_call-only; it freezes the badge on the last push-era run.
2. Keep badges current by running on main: per-board workflows get their main-branch runs from a path-selected dispatch on main (only boards affected by the change) plus a full sweep on a schedule. Scheduled sweeps skip when there are no new commits.
3. Full matrix is opt-in on branches: PRs run a representative subset; the full set only via a label (e.g. ci-full) or manual dispatch.
4. Compile once: one job builds the tool and uploads it; board jobs download it (policy-rust).
5. Cache saves from the default branch only (CACHE-003); other refs restore from it.
6. Storm response: document a one-liner to cancel all queued/in-progress runs for a repo, and loop it until empty, since pushes to main during the cancel start new runs.

Reference implementation: FastLED/fbuild#1574 (dispatch + compile-once + main-only caches) and FastLED/fbuild#1583 (badges pinned to main).