ci: harden checks and scope lint to owned paths

[sammargolis]

Summary

• hardens CI checks and aligns check scope to project-owned paths
• enforces test:no-phi-logs as a required compliance gate
• aligns branch-protection documentation to actual status checks

Security impact

• stronger CI gate coverage for code quality and compliance checks

PHI handling impact

• no runtime PHI flow changes
• adds stricter CI enforcement against PHI logging regressions

Tests executed

• pnpm build:test
• pnpm test:no-phi-logs

Rollback plan

• revert this PR to restore previous CI/check scoping behavior