Harden Android and workflow readiness checks

[yschimke]

What changed

• wait up to 60 seconds for an API 37 emulator to reach 1.1.1.1 before running the public ECH suite
• mark the public ECH cases skipped when the emulator never acquires an outbound route, while leaving the fixture suite gating
• run the network compile workflow when shared Gradle, wrapper, or Conscrypt-fetch inputs change
• run rerun-dashboard unit tests on relevant pull requests and before every live dashboard invocation
• validate Pages Python and JavaScript changes on pull requests without deploying them
• keep PR validation concurrency separate from production Pages and dashboard operations

Why

A half-ready Android emulator can have package services and storage without an outbound route, causing all six public ECH cases to fail with the same ENETUNREACH. Separately, several shared or operational files could change without receiving their relevant pre-merge checks.

The Android readiness gate classifies the network outage as unavailable infrastructure. The workflow changes ensure relevant edits schedule validation while preserving the intentionally scheduled/on-demand behavior of public network tests and production deployments.

Validation

• bash -n android-ech/run-ech-test.sh
• ANDROID_HOME=/Users/yschimke/Library/Android/sdk ./gradlew :android-ech:compileDebugAndroidTestKotlin
• python3 .github/scripts/test_job_reruns.py
• python3 -m compileall -q site/tools
• node --check for every site/assets/*.js
• YAML parsing for the three changed workflows
• git diff --check