Build the pull request through the path that publishes

The hosts were declared twice. cmake/hosts.json is what describe turns
into a lock, what build-sdk.yml matrixes over, and what build-host.sh
builds -- the route autobuilds takes to a published snapshot. Alongside
it, build.yml carried a hand-written matrix that reached the same hosts
by running cmake straight from the job.

Twice the runners was the cheap half of the cost. The expensive half is
that a pull request went green having exercised the route nobody
publishes: db4d1a5 merged with the Intel Mac host broken because its
macOS leg had never run build-host.sh, and buildscripts#168 was the same
shape. Third time this month.

So build.yml describes the revision under review and hands the lock to
build-sdk.yml, called by path so a change to the reusable workflow is
tested by its own pull request. The packaging tests move to checks,
where they belong -- they run against fixtures, not a built SDK -- and
the core package needs no job of its own, because create-core-package.sh
validates every package it writes and every packaged host now builds
one.

The pruned lock is ten legs against the old twelve jobs, and it verifies
more: the toolchain contract and the bootstrap smoke test now run on
every host that can run its own output, the Windows bootstrap gets a
real Windows runner, and the release tree is grouped. What it no longer
builds is i686-w64-mingw32, which describe prunes because nothing
publishes it. scripts/build-core-in-container.sh has no caller left.

Author: frangarcj