ci: build the Windows SYCL zip where its inputs change and check every tester leg before a cut (ADR-2198)

[lusoris]

BLUF: the x64 SYCL Windows tester zip was red on master from 2026-10-05 and nothing required noticed. This PR builds it on a pull request when an input it reads changes (light tier included) and makes the cut check every tester leg. Stacked on #2390 (ADR-2169): it edits .github/ci-tier.json and the tier gates that PR introduces, so it lands after it.

What changed

• .github/ci-impact.json: selector windows_tester_zip_sycl (own_paths_only): the x64 zip's inputs plus what only the SYCL leg reads (sycl-rows.json, prepare_build.py, build-config.env, the SYCL scratch ratchet list).
• .github/ci-tier.json + scripts/ci/ci_tier.py: own_input_lanes (validated on load): Windows Tester Zip plans and gates in the light tier; the release PR without the cut label still runs none of it.
• windows-tester-bundle.yml: planner and gate on outputs.light; a pull request builds x64, x64-sycl or both by selector; run-name on it, the macOS bundle and the tester image names the source of a dispatch.
• scripts/release/candidate-legs.json + check-candidate-legs.py: every Windows zip leg, the macOS bundle and the tester-image legs must be success on the exact commit (skipped, absent and red fail; a dispatch counts only when its title carries the full SHA). Release Script Contract runs it on the autorelease: cut pull request against its base commit; docs/development/release.md has the dispatch steps.
• Docs: docs/development/ci.md, docs/development/release.md, ADR-2198 (partly supersedes ADR-1595; cites Q-085), state row, changelog fragment, rebase note.

Evidence

• Last 91 master and dispatch runs of the zip workflow: the SYCL leg ran in 4, all red. Run 37271658228 was a transient (oneAPI installer file in use at deletion, retried since); 37281677119, 37292850622 and 37594655522 are the cfgmgr32.dll import error (fixed by fix(ci): accept cfgmgr32.dll as a Windows DLL in the Windows zip import check #2405). Not a second defect.
• Macos bundle: weekly schedule and dispatch only; tester image arm64 leg: push and dispatch only. Same hole, covered by the cut check.
• Planted red: test_check_candidate_legs.py (failed, skipped, absent, wrong-source dispatch, other commit, unfinished run) and the routing contract's mutations that put the lane back behind the full tier. Live: GH_TOKEN=$(gh auth token) python3 scripts/release/check-candidate-legs.py --sha 40e87b159d37d312066fef83047ae7c64d4ac3b4 exits 1 and names the eight Windows legs and the macOS leg.

Decisions

• Q-097: the x64 zip and the x64 SYCL zip each build on a pull request when their own inputs change.
• Q-098: the candidate head of the cut check is the release pull request's base commit.

Reproducer

python3 -m pytest scripts/ci/tests scripts/release/tests -q

Deliverables

• Research digest — no digest needed: trivial.
• Decision matrix — in ADR-2198 ## Alternatives considered.
• AGENTS.md invariant note — scripts/ci/AGENTS.d/ci-impact.md.
• Reproducer / smoke-test command — above.
• CHANGELOG fragment — changelog.d/changed/windows-sycl-leg-pr-gate-and-cut-check.md.
• Rebase note — docs/rebase-notes.md (fork-only CI).