Add lightweight CI for documentation changes

[olujicz]

Summary

• classify changed paths in a fast Ubuntu job before allocating macOS runners
• keep Gitleaks always enabled while skipping workflow lint, formatting, linting, tests, and the App Store smoke build only for documentation/image-only changes
• fail closed to full CI for code, workflow, build, mixed, empty, or indeterminate diffs
• cancel superseded runs for the same branch or pull request

Why

The previous workflow ran every macOS job for repository-discoverability changes such as README and image updates. That consumed runner time without exercising app code. This keeps the conservative required-check structure while avoiding unnecessary macOS work.

Validation

• just test
• .github/scripts/test-ci-scope.sh
• bash -n .github/scripts/ci-scope.sh .github/scripts/test-ci-scope.sh
• shellcheck .github/scripts/ci-scope.sh .github/scripts/test-ci-scope.sh
• actionlint .github/workflows/ci.yml
• git diff --check
• replayed the merged discoverability diff and confirmed full_ci=false
• confirmed Swift-only and mixed synthetic diffs return full_ci=true