1. only trigger docker-dryrun arm64&riscv64 when dockerfile changes 2. de-duplicate "contents: read" permission for most workflows 3. merge various "lint-*" jobs into one job 4. add missing lint targets to the "lint" (all) target
