Run CI jobs only for relevant changes

[BorisTyshkevich]

Summary

Make pull-request CI path-aware without skipping required workflows entirely.

What changed

• stop duplicate CI runs from arbitrary branch pushes; retain full CI on main, release tags, and manual dispatch
• classify PR paths once with dorny/paths-filter, pinned to commit d1c1ffe0248fe513906c8e24db8ea791d46f8590
• add a focused example-bundle normalization/contract job
• conditionally run unit coverage/build, size reporting, release-bundle smoke, and Playwright E2E jobs
• add a nightly Chromium/Firefox/WebKit E2E safety run
• add a stable CI gate job suitable for branch protection
• skip QEMU and the multi-arch Docker build for PRs that do not touch image inputs, using job-level conditions so the check still concludes successfully
• document the CI behavior in the changelog

Expected behavior

An examples-only PR runs the focused examples job and skips the full unit, build/size, bundle, E2E, and Docker jobs. Changes to workflow files intentionally exercise all affected jobs. Pushes to main, release tags, and manual dispatches retain full validation.

Validation

• both workflow files parse as YAML
• actionlint v1.7.12 passes
• node examples/mjs/normalize-examples.mjs --check
• git diff --check

The repository currently has no required status checks configured. After this lands, ci / CI gate can be selected as the single stable required check if desired.