ci: let a pull request keep the image it just built (#135)

Verified on this PR's own run rather than merged on the reasoning.

Across all 15 devices in the matrix:

```
Stage artifacts          15 success
Upload build artifacts   15 success
Send binary              15 skipped
Publish releases            skipped
CI Gate                     success
```

15 `fw-*` artifacts produced, and the retention the fix was about is what
actually landed:

```
fw-hi3516ev300_ultimate_rvi-1ncmw2028
  created  2026-08-27T21:17:00Z
  expires  2026-09-03T21:16:58Z   -> 7 days
```

So a pull request now keeps the images it built, for a week, while the two
paths that must stay closed to a PR -- the Telegram secret and shared release
assets -- are still closed.

.github/workflows/master.yml

@@ -274,10 +274,14 @@ jobs:
       # schemes the build used (compound devices rename to <device>-nor.tgz in
       # the workspace root, simple ones leave openipc.<soc>-nor-<variant>.tgz
       # under openipc/output/images/).
+      # Runs on pull_request too. Staging and the upload below are run-scoped
+      # and touch no secret and no shared state, so unlike `Send binary` and the
+      # `publish` job -- which stay gated, and must -- there is nothing here for
+      # a PR to leak or clobber. Without this a contributor's PR compiles a full
+      # image and then discards it, so they cannot test their own device profile
+      # without asking a maintainer to dispatch build-one for them.
       - name: Stage artifacts
-        if: >-
-          github.event_name != 'pull_request' &&
-          (env.NORFW || env.NANDFW)
+        if: env.NORFW || env.NANDFW
         run: |
           mkdir -p dist
           for f in "${NORFW:-}" "${NANDFW:-}" "${SIZES:-}"; do
@@ -297,15 +301,24 @@ jobs:
       # contention (run 27108181857: every board built, 14 jobs red in their
       # upload step). Consolidating every release write into one job removes the
       # concurrent-writer contention that causes it.
+      #
+      # `publish` carries its own `github.event_name != 'pull_request'`, so
+      # producing fw-* on a PR cannot reach a release; it only makes the image
+      # downloadable from the run that built it.
+      #
+      # Retention is per-event deliberately. A nightly's artifact is consumed by
+      # `publish` inside the same run and no one downloads it afterwards, and a
+      # nightly builds the entire device matrix -- holding those a week would
+      # keep seven full matrices in storage instead of one, for no reader. A PR
+      # builds a handful and has a person waiting on them, plausibly in another
+      # timezone, so one day is too short a window there.
       - name: Upload build artifacts
-        if: >-
-          github.event_name != 'pull_request' &&
-          (env.NORFW || env.NANDFW)
+        if: env.NORFW || env.NANDFW
         uses: actions/upload-artifact@v4
         with:
           name: fw-${{ matrix.platform }}
           if-no-files-found: ignore
-          retention-days: 1
+          retention-days: ${{ github.event_name == 'pull_request' && 7 || 1 }}
           path: dist/*
 
       - name: Send binary