Add a changes job that diffs the pushed range (or PR base) and emits a matrix via ci-matrix.sh. Shared files or build tooling changes rebuild all images. Also fix the upstream package trim to drop top-level keys left empty (e.g. packages-x86_64 when every entry is excluded), which broke fedora-remote.