[kevmo314]

Speeds up CI and clears the Node 20 deprecation warnings.

Path filters. rtchat.yml, flutter-test.yml and flutter-integration-test.yml skip PRs that only touch agent/, functions/, auxiliary/, Markdown, or the backend workflows. Pushes to main, releases and dispatches are not filtered. flutter-analyze.yml (analyze), CodeQL and firebase-functions-pull-request.yml (build) are required checks and are not filtered.

Caching.

• gradle/actions/setup-gradle@v6 in the Kotlin unit test job and the integration test. Following the action's default, only main writes the cache, so PRs get faster after this merges.
• subosito/flutter-action cache: true everywhere. This caches the SDK and the pub cache.
• AVD snapshot cache for the integration test, per the android-emulator-runner docs.
• npm cache for the functions PR check.

Concurrency.

• PR runs cancel superseded runs in the integration test, rtchat app, flutter test and flutter analyze workflows.
• Runs on main are no longer cancelled. The integration test used to cancel them.
• The agent and auxiliary deploys used the same deploy group, so they could cancel each other. They now use agent-deploy and auxiliary-deploy.

Agent image.

• Multi-stage build: a static CGO_ENABLED=0 binary built with BuildKit cache mounts, running on gcr.io/distroless/static-debian13:nonroot. That base has ca-certificates, tzdata and a nonroot user, and time zones are also embedded through time/tzdata.
• Same entrypoint path (/go/bin/app), no args, port 8080.
• The image is now about 39 MB. Before, it was the full golang:alpine toolchain image.
• Adds agent/.dockerignore.
• PRs build the image but don't push it or log in, so fork PRs work. Pushes to main still push :main for the deploy.

Action bumps (Node 24):

• checkout v7, setup-node v7, setup-java v6, setup-go v7, cache v6, upload-artifact v7
• google-github-actions auth v3 / setup-gcloud v3
• docker setup-buildx v4 / login v4 / metadata v6 / build-push v7
• CodeQL v4
• auxiliary.yml's v0/v1 pins and periodic-restart's v1 pins

invertase/github-action-dart-analyzer has no Node 24 release, so it is replaced with dart analyze --format=machine. This keeps the same fatality (errors and warnings fail, infos don't) and turns each issue into an annotation.

iOS bundle ID. rtchat.yml passes bundle-id: com.rtirl.chat to muxable/.github's flutter-ios.yml.

firebase-functions-pull-request.yml stays unfiltered because its build job is the required build check. It only gains the npm cache.