Run selected CI jobs behind one required gate

[lovasoa]

README/media-only PRs currently either miss required checks entirely or run the complete Rust, database, browser and Docker matrix. Keep CI triggered for every PR, but select the expensive jobs only when files outside the existing README/docs exclusions change. Mixed changes and unknown file types select the full core matrix. Pushes, tags, merge groups, and PRs beyond the files API limit never take the docs-only fast path. Existing test steps, matrices and Hurl example selection are preserved.

Add one always-run CI gate that waits for every test job. It accepts intentional docs-only and empty-Hurl skips, and rejects failed/cancelled jobs, failed or ambiguous selection, malformed Hurl outputs, and unexpectedly skipped required suites. Publishing remains outside the test gate.

Required-check migration

After this PR's CI gate succeeds, replace the main-branch ruleset's four existing CI requirements (compile_and_lint, playwright, and the PostgreSQL/MSSQL test matrix checks) with CI gate, using GitHub Actions as the expected source. Preserve the current strict/up-to-date policy. This PR does not modify repository settings. Keeping the old matrix requirements would still block docs-only PRs when those matrices are skipped.

Validation

• npm test: 82 tests passed, including 45 gate regression cases covering success, intentional and unexpected skips, failure, cancellation, and missing/malformed outputs.
• actionlint 1.7.12 passed; optional ShellCheck/Pyflakes integrations disabled (no shell/Python code changed).
• Parsed workflow and exercised README, media, hidden docs, workflow, source, mixed and rename-path selection cases; verified every existing test's steps and matrix are unchanged and the gate covers every test job.
• git diff --check passed.