WIP cirrus: trigger after github action finishes

(TODO this is totally untested and mostly vibe coded.)

Whenever we push changes do docker/**, our docker images for Cirrus
CI will be rebuilt.

However, the Cirrus CI jobs will kick off at the same time as the
Docker builds, so they will likely use old images.  This can cause
surprising (albeit transient) failures.

Fix this by having Cirrus wait for GitHub Actions.

This addresses the second part of
https://github.com/fish-shell/fish-shell/pull/11884#discussion_r2423344925

.cirrus.yml

@@ -1,3 +1,5 @@
+skip: $CIRRUS_REPO_OWNER == 'fish-shell' && $CIRRUS_BRANCH == 'master'
+
 env:
     CIRRUS_CLONE_DEPTH: 100
     CI: 1

.github/workflows/build_docker_images.yml

@@ -4,8 +4,6 @@ on:
   push:
     branches:
       - master
-    paths:
-      - 'docker/**'
   workflow_dispatch:
 
 concurrency:
@@ -14,10 +12,26 @@ concurrency:
 env:
   REGISTRY: ghcr.io
   NAMESPACE: fish-ci
+  ONLY_FOR_REPO_OWNER: fish-shell
 
 jobs:
+  check-docker-changes:
+    if: github.repository_owner == env.ONLY_FOR_REPO_OWNER
+    runs-on: ubuntu-latest
+    outputs:
+      docker-changed: ${{ steps.changes.outputs.docker }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dorny/paths-filter@v3
+        id: changes
+        with:
+          filters: |
+            docker:
+              - 'docker/**'
+
   docker-build:
-    if: github.repository_owner == 'fish-shell'
+    needs: check-docker-changes
+    if: github.repository_owner == env.ONLY_FOR_REPO_OWNER && needs.check-docker-changes.outputs.docker-changed == 'true'
     permissions:
       contents: read
       packages: write
@@ -82,3 +96,31 @@ jobs:
           file: docker/${{ matrix.target }}.Dockerfile
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+
+  trigger-cirrus:
+    needs: [check-docker-changes, docker-build]
+    if: always() && github.repository_owner == env.ONLY_FOR_REPO_OWNER
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger Cirrus CI
+        env:
+          CIRRUS_TOKEN: ${{ secrets.CIRRUS_TOKEN }}
+        run: |
+          set -x
+          # N.B. push-triggered workflows are usually from master.
+          branch=${{ github.ref_name }}
+          repository_id=${{ github.repository_id }}
+          curl -X POST \
+            -H "Authorization: Bearer $CIRRUS_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d '{
+              "query": "mutation {
+                createBuild(input: {
+                  repositoryId: \"$repository_id\",
+                  branch: \"$branch\"
+                })
+                { build { id } }
+              }"
+            }' \
+            https://api.cirrus-ci.com/graphql
+