ci: only rebuild images whose files changed

Add a changes job that diffs the pushed range (or PR base) and emits a matrix
via ci-matrix.sh. Shared files or build tooling changes rebuild all images.
Also fix the upstream package trim to drop top-level keys left empty (e.g.
packages-x86_64 when every entry is excluded), which broke fedora-remote.

build.sh

@@ -111,7 +111,26 @@ trim_upstream_packages() {
         print
       }
     ' "${blocklist}" "${f}" > "${f}.tmp"
-    mv "${f}.tmp" "${f}"
+    # Drop top-level keys that were left with no list items (e.g. if every
+    # entry under packages-x86_64: was removed).
+    awk '
+      { lines[NR] = $0 }
+      END {
+        for (i = 1; i <= NR; i++) {
+          if (lines[i] ~ /^[A-Za-z0-9_.-]+:$/) {
+            keep = 0
+            for (j = i + 1; j <= NR; j++) {
+              if (lines[j] ~ /^[[:space:]]+-[[:space:]]/) { keep = 1; break }
+              if (lines[j] ~ /^[A-Za-z0-9_.-]+:/) break
+            }
+            if (!keep) continue
+          }
+          print lines[i]
+        }
+      }
+    ' "${f}.tmp" > "${f}.tmp2"
+    mv "${f}.tmp2" "${f}"
+    rm -f "${f}.tmp"
   done
 }