perf(ci): path-filtered builds — skip //cdk:test on non-CDK PRs — follow-up to #363

Parent: #363. Spun from #363's DoD by the orchestrator; **needs maintainer `approved` (ADR-003)**.

## Goal
Make the expensive `//cdk:test` step conditional (e.g. `dorny/paths-filter`) so docs/CLI/agent-only PRs skip it while the required `build` check still reports success.

## Scope
- Path filter drives whether cdk test runs.
- **Annotate what was skipped** so a skipped suite is never mistaken for a covered one (silent-truncation guard).
- Biggest win for the non-CDK long tail.

Refs #363

Read ADR-003 and the CI configuration that defines the required build check and //cdk:test; use #363 for the existing definition of done. Verify that non-CDK docs/CLI/agent-only PRs skip the suite, skipped work is annotated, and the required build check still succeeds.

Written by the indexing model from the issue text.