ci: skip full runtime pipeline for documentation-only changes

## Problem

Documentation-only changes currently run the full Go, race, envtest, image-adjacent verification, and Kind acceptance pipeline. This consumes time and runner capacity without increasing confidence, while documentation still needs its own deterministic validation.

## Goal

Introduce path-sensitive CI that gives documentation-only changes a fast, meaningful gate and preserves the complete pipeline for anything that can affect APIs, generated artifacts, packaging, runtime behavior, or tests.

## Scope

- classify a change set in-repository without mutable third-party action tags
- run a lightweight documentation job for Markdown-only changes
- validate Markdown lint, local links, fenced shell/YAML examples, and changed-file secret scanning
- skip Go/race/envtest/Kind work only when every changed file is documentation-only
- treat workflow, API, Go, chart, KCL, manifest, generator, build, test, and dependency changes as full-pipeline changes
- expose an always-present aggregate required check so branch protection is not weakened by conditional jobs
- document the classification and how to force a full run when uncertain

## Acceptance criteria

- [ ] a Markdown-only pull request runs the docs gate but not full verify or Kind jobs
- [ ] a change to `.github/workflows`, Go, CRDs, Helm, KCL, tests, scripts, or dependency metadata runs the full pipeline
- [ ] mixed docs/code changes run both relevant documentation checks and the full pipeline
- [ ] the aggregate required check fails if any selected job fails and succeeds only when classification and selected jobs succeed
- [ ] push-to-main and pull-request diff bases are handled correctly, including a zero/unknown `before` SHA
- [ ] workflow logic is unit- or fixture-tested against representative path sets
- [ ] action pins and least-privilege permissions remain intact