feat(template): skip the nightly backup when the template hasn't changed

template backup ran a full multi-GB, multi-minute 7z pass over every
template every night regardless of whether anything under it had actually
changed -- the systemd unit's own comment already noted the resulting
archives were byte-identical run to run. Now compares the template dir's
newest file mtime against its most recent existing backup and skips the
compress step (still honoring --keep-count via prune) when nothing is
newer. --force opts back into an unconditional backup.

deploy/systemd/ci-backup-template.service

@@ -17,8 +17,11 @@ WorkingDirectory=/opt/ci/local-ci-cd-system
 ExecStartPre=/usr/bin/install -d -o ci-runner -g ci-runner -m 750 /var/lib/ci/backups
 # --keep-count 1: three generations of Windows templates cost ~195 GB and the
 # archives were byte-identical between runs (the templates rarely change), so
-# the extra generations bought nothing. --exclude WinBuildTest: retired test
-# template, ~26 GB per generation.
+# the extra generations bought nothing. Since the archives were identical,
+# `template backup` now also skips the 7z pass itself by default whenever the
+# template directory has not changed since its last backup (no flag needed
+# here; --force would opt back into an unconditional backup).
+# --exclude WinBuildTest: retired test template, ~26 GB per generation.
 ExecStart=/opt/ci/venv/bin/python -m ci_orchestrator template backup --all-templates --keep-count 1 --exclude WinBuildTest
 # Safety net: bring act-runner.service back up on any exit path (success,
 # failure, signal). The Python `finally` block can be skipped if the