Make reduced release scope explicit in builds and validation

When temporarily enabling only one subsystem, model the scope as a typed GitHub Actions input and pass the same scope into both the build matrix and a fail-closed validator. Keep the full scope as the default. The reduced scope should remove only dependencies unique to the deferred subsystem; it must still validate fixed environment identities, shared credentials, provider routes, safety flags, observability labels, and forbidden production targets. Tests should prove the deferred image is not built, its credentials may be absent, and production migration paths remain unreachable. This applies only when the subsystems are genuinely separable.

Applies when: A staged release enables one independently deployable subsystem before the rest. Keywords: GitHub Actions matrix release scope validation credentials isolation production migration