ci: contain gfql-only test fanout

[lmeyerov]

Summary

• Adds a conservative gfql_only path classifier for GFQL-owned implementation, model, benchmark, and test paths.
• Uses gfql_only through narrow_python_only to skip unrelated docs, middle-version REST, graphviz, Neo4j, build, and DGL fanout for GFQL-only PRs.
• Keeps GFQL/TCK/cypher, pandas/GFQL, polars, changed-line coverage, and test-core-python so coverage-critical GFQL checks remain on.
• Keeps NetworkX policy for GFQL/cypher lowering/procedure paths plus GFQL logical/physical procedure planning files.
• Keeps broad fail-closed behavior for docs/source, gfql_unified.py, Plottable.py, shared compute, schema, workflow, and infra edits.

Safety checks

• git diff --check
• Extracted changes-job shell block with bash -n
• PyYAML parse of .github/workflows/ci.yml: 32 jobs
• Source-derived scenario evaluator covering GFQL-only, GFQL docs, gfql_unified.py, shared compute, schema, workflow infra, NetworkX lowering, GFQL procedure planning, NetworkX test-only, and docs-test-support cases

Historical target

Latest-30 merged PR sampling after #1690/#1691/#1692/#1694 showed GFQL/cypher as the largest remaining safe opportunity: 11 of 30 sampled non-CI-stack merged PRs were GFQL/cypher-shaped.

Coverage notes

GFQL-only still runs changed-line-coverage and test-core-python to preserve the core coverage artifact. NetworkX policy still runs for GFQL/cypher lowering/procedure paths and GFQL procedure-call planning files that can affect NetworkX behavior.