ci: only rebuild images whose files changed

Add a changes job that diffs the pushed range (or PR base) and emits a matrix
via ci-matrix.sh. Shared files or build tooling changes rebuild all images.
Also fix the upstream package trim to drop top-level keys left empty (e.g.
packages-x86_64 when every entry is excluded), which broke fedora-remote.

ci-matrix.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Print the CI build matrix (JSON) for the images affected by the paths on
+# stdin (one per line). Any change to shared files or the build tooling
+# rebuilds every image. Empty input (e.g. schedule/manual runs) rebuilds all.
+set -euo pipefail
+
+changed="$(cat || true)"
+
+all=0
+[[ -z "${changed}" ]] && all=1
+grep -qE '^(build\.sh|release\.sh|prune-releases\.sh|prune-registry\.sh|ci-matrix\.sh|\.gitea/)' <<< "${changed}" && all=1
+grep -qE '^images/shared/' <<< "${changed}" && all=1
+
+cosmic=0
+remote=0
+if [[ "${all}" == 1 ]]; then
+  cosmic=1
+  remote=1
+fi
+grep -qE '^images/fedora-cosmic/' <<< "${changed}" && cosmic=1
+grep -qE '^images/fedora-remote/' <<< "${changed}" && remote=1
+
+entries=()
+if [[ "${cosmic}" == 1 ]]; then
+  entries+=('{"image":"fedora-cosmic","distro":"44","arch":"x86_64","runner":"job-v2"}')
+  entries+=('{"image":"fedora-cosmic","distro":"rawhide","arch":"x86_64","runner":"job-v2"}')
+fi
+if [[ "${remote}" == 1 ]]; then
+  entries+=('{"image":"fedora-remote","distro":"44","arch":"x86_64","runner":"job-v2"}')
+fi
+
+joined="$(IFS=,; printf '%s' "${entries[*]:-}")"
+printf '{"include":[%s]}\n' "${joined}"