ci: skip full runtime pipeline for documentation-only changes

## Problem

Documentation-only changes currently run the full Go, race, envtest, image-adjacent verification, and Kind acceptance pipeline. This consumes time and runner capacity without increasing confidence, while documentation still needs its own deterministic validation.

## Goal

Introduce path-sensitive CI that gives documentation-only changes a fast, meaningful gate and preserves the complete pipeline for anything that can affect APIs, generated artifacts, packaging, runtime behavior, or tests.

## Scope

- classify a change set in-repository without mutable third-party action tags
- run a lightweight documentation job for Markdown-only changes
- validate Markdown lint, local links, fenced shell/YAML examples, and changed-file secret scanning
- skip Go/race/envtest/Kind work only when every changed file is documentation-only
- treat workflow, API, Go, chart, KCL, manifest, generator, build, test, and dependency changes as full-pipeline changes
- expose an always-present aggregate required check so branch protection is not weakened by conditional jobs
- document the classification and how to force a full run when uncertain

## Acceptance criteria

- [ ] a Markdown-only pull request runs the docs gate but not full verify or Kind jobs
- [ ] a change to `.github/workflows`, Go, CRDs, Helm, KCL, tests, scripts, or dependency metadata runs the full pipeline
- [ ] mixed docs/code changes run both relevant documentation checks and the full pipeline
- [ ] the aggregate required check fails if any selected job fails and succeeds only when classification and selected jobs succeed
- [ ] push-to-main and pull-request diff bases are handled correctly, including a zero/unknown `before` SHA
- [ ] workflow logic is unit- or fixture-tested against representative path sets
- [ ] action pins and least-privilege permissions remain intact

Read the existing files under .github/workflows and the current verification and Kind job entry points. Trace pull-request and push-to-main diff handling, including zero or unknown before SHAs, then inspect how workflow logic can be fixture-tested for representative path sets. Done means documentation-only changes use the docs gate, other changes retain the full pipeline, and the aggregate check reports selected-job results.

Rédigé par le modèle d'indexation à partir du texte de l'issue.