Main path filtering can skip changes from canceled validation runs

> 🤖 Generated by the Agentic Engineer

## Problem

`main` validation can report green after an earlier Go-affecting push was canceled, because the replacement run evaluates only the latest push's path filter. A later docs-only commit can therefore skip Go validation even though the default branch contains an unvalidated Go/dependency change.

## Evidence

- Dependabot PR #6340 merged desktop Go dependency changes in commit `46c1c722a00422b97b9425e87677364b2fef74d7`.
- PR #6334 then merged the fail-closed Claircore guard in `beef5c81f3bcaab417e0902f0edff11eda7f92ed`.
- Their post-merge CI runs were canceled as later dependency/docs commits advanced `main`.
- Current `main` at `6883c0c96761c5e47801e305094a9054994b9d77` reported green in CI run 29972343451 and required-workflow run 29972382525, but a direct focused test fails:

`go test ./pkg/client/kubescape -run TestClaircoreLinkedPackagesStayInert -count=1`

The desktop module resolves Claircore `v1.5.53` while the audited version was `v1.5.35`.

## Impact

A broken or security-sensitive Go change can remain on the default branch with a green latest status when an in-progress validation is superseded by a later commit whose paths do not select the same checks.

## Expected behavior

The latest default-branch status must cover every change since the last successfully validated default-branch state, even when intermediate runs are canceled or superseded.

## Acceptance criteria

- Add a reproducing workflow-contract test for a Go-affecting main push superseded by a docs-only push.
- Ensure the replacement/default-branch run executes Go validation for the accumulated unvalidated range, or stop canceling the only validating run for that range.
- Keep pull-request path filtering intact where it is safe.
- Add negative controls proving consecutive docs-only changes do not unnecessarily run the full Go suite.
- Document the cancellation/path-selection invariant in the workflow harness.

## Rough size

Medium: workflow concurrency/range selection plus mutation-tested harness coverage.