ci: fix nine ways the selection under-selected or mismatched

Every one of these dropped coverage silently - the worst failure mode here,
because the PR still goes green. Found by review, each reproduced first.

Selection rules:

* class_macros derived the config macro from the class DIRECTORY, so a change to
  src/class/midi/midi2_device.c selected the midi_test examples (which do not
  compile it) and never examples/device/midi2_device (the only one that enables
  CFG_TUD_MIDI2, and the only one that does). The file's own macro is unioned in
  where it differs - union, never replace: over-selecting costs a build,
  under-selecting merges a break.
* the ${FAMILY_MCUS} fallback added for espressif fired on any family whose
  _family_mcus came back empty, and _cmake_sets is if()-blind and keeps the FIRST
  definition - so mcx/frdm_mcxn947 answered MCXA15, a token six examples' skip.txt
  names, dropping 12 firmware images CMake builds. Limited now to families that
  never spell set(FAMILY_MCUS ...) at all.
* lib_examples read only an example's top-level CMakeLists.txt/Makefile;
  host/msc_file_explorer_freertos names lib/embedded-cli in src/CMakeLists.txt and
  survived by luck. The whole example tree is scanned. (SEGGER_RTT and rt-thread
  still resolve to nothing: all three references sit inside a LOGGER=rtt guard no
  CI build sets - the documented ruling, not a miss.)
* get_family_boards applied ci_skip_boards/ci_preferred_boards only under
  GITHUB_ACTIONS/CIRCLECI, so the selector answered differently on a laptop than
  on a runner; _prune_buildable forces CI semantics. Its one-board pick also
  abandoned the whole preferred list when entry one could not build the -e set,
  and asked skip_example without the build's -D tokens.
* _config_enables and lib_examples still read with the locale encoding - under
  LC_ALL=C the selector tracebacked on three tracked tusb_config.h files. The
  whole selector and its suite run clean there now.

Workflows:

* the Membrowse Upload step omitted $EX_ARGS, but --one-first now picks the board
  from the -e set, so it configured a different, empty build dir and uploaded
  --identical for a board never compiled. It takes $EX_ARGS for the BOARD; the
  target stays the aggregate, which has no DEPENDS and still records every example.
* blanking FAM_REGEX reset only build_filtered, leaving the build scoped while
  code-metrics took the UNSCOPED branch and diffed a 1-family run against the full
  averaged baseline. All three drop together now, as CircleCI's fall-open does.
* CircleCI's EX_ARGS had no character screen and is used unquoted, and its
  code-metrics job still exit 1'd on an empty metrics set - which a scoped build
  makes a legitimate outcome.
* a `ci-full` PR label now turns the scoping off for one PR. A selector bug
  under-selects silently, and without a label the only ways back to a full matrix
  are accidental.

Performance, since the selector gates every other job: family.cmake texts are read
once rather than per changed directory (a 6,000-file dep bump re-read 84 files
99,892 times) and _scrape_mcu is cached: 2.2s -> 0.29s there, 0.8s -> 0.33s on a
class diff.

Tests: a drift guard for hw/bsp families absent from ci_set_matrix.family_list
(they select zero legs now, where they used to ride the full matrix); the rule-4
port test asserted a SUBSET, which set() satisfies, so it could not fail on the
empty selection it exists to catch; the GITHUB_ENV guard test counted a SUM of two
guards. Drops metrics.py's --only-examples, which nothing called, and applies the
TOTAL scrub to the by-example branch that skipped it.

1 files changed, 12 insertions, 2 deletions

diff --git a/tools/build_utils.py b/tools/build_utils.py
index 2af8fd624..1eeef0269 100755
--- a/tools/build_utils.py
+++ b/tools/build_utils.py
@@ -141,9 +141,12 @@ def _family_mcus(family_dir, board_dir):
     board_cmake = pathlib.Path(board_dir) / "board.cmake"
     out = set()
     depth = 0
+    any_set = False
     for line in text.splitlines():
         line = line.strip()
         m = _FAMILY_MCUS_RE.match(line)
+        if m:
+            any_set = True
         if m and depth == 0:
             files = (str(board_cmake), str(fam_cmake))
             for tok in m.group(1).split():
@@ -156,16 +159,23 @@ def _family_mcus(family_dir, board_dir):
             depth += 1
         elif re.match(r'endif\s*\(', line):
             depth = max(0, depth - 1)
-    if not out:
+    if not out and not any_set:
         # FAMILY_MCUS can also be produced rather than set: hw/bsp/espressif derives it
         # with `string(TOUPPER ${IDF_TARGET} FAMILY_MCUS)`, which _FAMILY_MCUS_RE cannot
-        # see, leaving espressif's whole cmake answer resting on the IDF_TARGET scrape
+        # see, leaving espressif's whole cmake answer resting on the IDF_TARGET scrape.
+        #
+        # `not any_set` is load-bearing: _cmake_sets is if()-blind and keeps the FIRST
+        # definition, so on a family that sets FAMILY_MCUS only inside conditionals
+        # (mcx, nrf) this would leak branch one's value onto every board - mcx/frdm_mcxn947
+        # answered MCXA15, which six examples' skip.txt names, dropping 12 firmware
+        # images CMake actually builds. Those families keep the CFG_TUSB_MCU scrape.
         val = _cmake_expand('${FAMILY_MCUS}', (str(board_cmake), str(fam_cmake)))
         if val:
             out.add(val)
     return frozenset(out)
 
 
[email protected]_cache(maxsize=None)
 def _scrape_mcu(family_dir, board_dir, family):
     """(CFG_TUSB_MCU token of this board, the text it was read from), master's
     algorithm verbatim: family.mk (family.cmake when there is none) first, falling