build-push: workflow_dispatch input only to rebuild a single image leg

Gitea cannot re-run one job and a full run takes ~1h. Add a plan job that
turns the optional `only` input (e.g. cac:php85) into one filtered matrix per
image family; image jobs take their matrix from it and are skipped when empty.
Push events / empty input plan the full set as before. Unknown values fail
the plan job. Tests added to multiarch-workflow.test.py.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb

.gitea/scripts/plan-legs.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+## plan-legs.sh - decide which image legs of build-push.yaml run.
+##
+## Env:
+##   ONLY         workflow_dispatch input "only". Empty/blank (and every push
+##                event) = build everything, exactly as before.
+##   GITHUB_OUTPUT  file the outputs are appended to (set by the runner).
+##
+## ONLY is a comma list of tokens (spaces ignored):
+##   cac:php85  cac-fpm:php84  cac-litespeed:php83  cac-lsphp:php82   one leg
+##   cac | cac-fpm | cac-litespeed | cac-lsphp                         every PHP version of that image
+##   shared-httpd | shared-ols                                         that image
+## Any other token is an error (exit 2, nothing is written): a typo must fail
+## the plan job loudly, never silently build nothing.
+##
+## Outputs (matrix families = JSON array of phpver, [] = skip the job;
+## single-leg images = true|false):
+##   cac cac_fpm cac_litespeed cac_lsphp shared_httpd shared_ols
+set -euo pipefail
+
+MATRIX_FAMILIES=(cac cac-fpm cac-litespeed cac-lsphp)
+SINGLE_FAMILIES=(shared-httpd shared-ols)
+ALL_PHPVER=(82 83 84 85)
+
+die() { echo "plan-legs: $*" >&2; exit 2; }
+
+only=${ONLY-}
+only=${only//[[:space:]]/}
+
+declare -A want_ver want_single
+want_all=false
+
+if [ -z "$only" ]; then
+  want_all=true
+else
+  n=0
+  IFS=',' read -r -a toks <<< "$only"
+  for t in "${toks[@]}"; do
+    [ -n "$t" ] || continue
+    n=$((n + 1))
+    fam=${t%%:*}
+    ver=""
+    if [ "$fam" != "$t" ]; then
+      ver=${t#*:}
+      [ -n "$ver" ] || die "empty PHP version in '$t'"
+    fi
+    if [[ " ${MATRIX_FAMILIES[*]} " == *" $fam "* ]]; then
+      if [ -z "$ver" ]; then
+        for v in "${ALL_PHPVER[@]}"; do want_ver["$fam:$v"]=1; done
+      elif [[ "$ver" =~ ^php(8[2-5])$ ]]; then
+        want_ver["$fam:${BASH_REMATCH[1]}"]=1
+      else
+        die "unknown PHP version in '$t' (want ${fam}:php82 .. ${fam}:php85)"
+      fi
+    elif [[ " ${SINGLE_FAMILIES[*]} " == *" $fam "* ]]; then
+      [ "$fam" = "$t" ] || die "'$t': $fam has a single leg, use plain '$fam'"
+      want_single["$fam"]=1
+    else
+      die "unknown image '$t' (known: ${MATRIX_FAMILIES[*]} ${SINGLE_FAMILIES[*]})"
+    fi
+  done
+  [ "$n" -gt 0 ] || die "'only' has no usable entries: '$only'"
+fi
+
+matrix_json() {  # family
+  local fam=$1 v out=""
+  for v in "${ALL_PHPVER[@]}"; do
+    if $want_all || [ -n "${want_ver["$fam:$v"]-}" ]; then out+="${out:+,}$v"; fi
+  done
+  printf '[%s]' "$out"
+}
+single_json() {  # family
+  if $want_all || [ -n "${want_single["$1"]-}" ]; then echo true; else echo false; fi
+}
+
+out=${GITHUB_OUTPUT:-/dev/stdout}
+{
+  echo "cac=$(matrix_json cac)"
+  echo "cac_fpm=$(matrix_json cac-fpm)"
+  echo "cac_litespeed=$(matrix_json cac-litespeed)"
+  echo "cac_lsphp=$(matrix_json cac-lsphp)"
+  echo "shared_httpd=$(single_json shared-httpd)"
+  echo "shared_ols=$(single_json shared-ols)"
+} >> "$out"