ci(test): prefetch Electron only when the selected specs exec it

Review feedback: the unconditional unit-job step made PRs that skip the
Tier A suite depend on an Electron download, and the coverage:unit:ci
prefix did the same for filtered local runs of projects that never
spawn Electron.

The Tier A runner now prefetches only when a selected project has a spec
calling createRequire(...)('electron'), and the CI step runs after the
scope decision and only when the suite is in scope.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -371,15 +371,6 @@ jobs:
             - name: Install dependencies
               run: pnpm install --frozen-lockfile
 
-            # pnpm skips Electron's postinstall (it is not in
-            # onlyBuiltDependencies), so the binary is fetched on the first
-            # require('electron'). Specs that run SQLite under
-            # ELECTRON_RUN_AS_NODE resolve it that way while Tier A projects
-            # run concurrently, and one exec'ing it mid-extraction fails with
-            # ETXTBSY. Download and verify it once, before any test starts.
-            - name: Download Electron binary
-              run: node tools/testing/ensure-electron-binary.mjs
-
             - name: Validate agent guidance
               run: pnpm run agents:validate
 
@@ -436,6 +427,19 @@ jobs:
                       --paginate --jq '.[] | .filename, (.previous_filename // empty)' |
                       node tools/coverage/unit-coverage-scope.mjs --base FETCH_HEAD --github-output
 
+            # pnpm skips Electron's postinstall (it is not in
+            # onlyBuiltDependencies), so the binary is fetched on the first
+            # require('electron'). Specs that run SQLite under
+            # ELECTRON_RUN_AS_NODE resolve it that way while Tier A projects
+            # run concurrently, and one exec'ing it mid-extraction fails with
+            # ETXTBSY. Download and verify it once, before any test starts;
+            # the Tier A runner does the same, so this step only separates a
+            # download failure from test failures. Skipped suites need no
+            # binary.
+            - name: Download Electron binary
+              if: steps.scope.outputs.run == 'true'
+              run: node tools/testing/ensure-electron-binary.mjs
+
             # Jest's transform cache (TypeScript/Angular transpilation plus
             # coverage instrumentation, keyed by file content) is persisted
             # between runs. Only master pushes and maintainer dispatches save