fix(ci): preserve workflow concurrency and portable artifact checks

.github/workflows/build-exe-for-python-sdk.yml

@@ -260,7 +260,7 @@ jobs:
         if: inputs.ci && github.event_name == 'pull_request'
         env:
           DSH_BUILD_CLIENT_PROFILE: official
-        run: pnpm run build:artifacts
+        run: pnpm run build --artifacts-only
 
       - name: Build single-exe
         env:

.github/workflows/build-preview-cloudflare.yml

@@ -71,7 +71,7 @@ jobs:
       # build:preview packs the image through the packer's installed bin
       # (lib/bin.js), so neither half exists before the full build runs.
       - name: Build workspace
-        run: pnpm run build:artifacts
+        run: pnpm run build --artifacts-only
 
       - name: Build the preview page and pack the VFS image
         env:

.github/workflows/e2e.yml

@@ -107,7 +107,7 @@ jobs:
       # the built artifact under plain Node, resolving plugins through real package
       # exports — the shape a real consumer runs. That requires a prior build.
       - name: Build (lib for the e2e example bins)
-        run: pnpm run ${{ github.event_name == 'pull_request' && 'build:artifacts --profile official' || 'build:official' }}
+        run: ${{ github.event_name == 'pull_request' && 'pnpm run build --artifacts-only --profile official' || 'pnpm run build:official' }}
 
       - name: Prepare Office runtime
         run: pnpm run prepare:primary-runtime --target linux-x64 --output .cache/e2e-office

.github/workflows/release-vendor.yml

@@ -89,7 +89,7 @@ jobs:
       # The vendored packages publish their own sources and build outputs; the
       # host build produces what their manifests select.
       - name: Build
-        run: pnpm run ${{ github.event_name == 'pull_request' && 'build:lib:host:artifacts' || 'build:lib:host' }}
+        run: ${{ github.event_name == 'pull_request' && 'pnpm exec tsx scripts/compile-referenced-projects.ts host-libraries' || 'pnpm run build:lib:host' }}
 
       # Concurrency here is rehearsal-only: the credentialed publish workflows
       # invoke release:pack without the flag and keep the strictly serial path.

.github/workflows/release.yml

@@ -146,7 +146,7 @@ jobs:
         run: pnpm run release:verify --family dsh
 
       - name: Build
-        run: pnpm run ${{ github.event_name == 'pull_request' && 'build:artifacts --profile official' || 'build:official' }}
+        run: ${{ github.event_name == 'pull_request' && 'pnpm run build --artifacts-only --profile official' || 'pnpm run build:official' }}
 
       # Concurrency here is rehearsal-only: the credentialed publish workflows
       # invoke release:pack without the flag and keep the strictly serial path.