ci: reduce repeated validation spend

[fcoury]

Repeated pushes and merge events currently rerun the full paid WarpBuild matrix, including work already validated on the pull request. This change keeps cross-platform PR coverage while making post-merge validation substantially cheaper and cancelling superseded work.

The workflow now selects paid coverage by event: code PRs retain Ubuntu, macOS, and Windows; documentation-only PRs skip paid tests; pushes use one Ubuntu 8x smoke runner; and manual runs can request either scope. A stable CI Gate validates the expected success or skip result for every terminal job. Clippy is reduced to one Ubuntu job on code PRs and manual runs, with post-merge and docs-only Clippy skipped.

The PR also adds a confirmation-gated runner-sizing benchmark, an importable main ruleset recipe, policy regression tests, and a rollout runbook covering WarpBuild budgets and monitoring.

How to Test

1. Inspect Plan validation on this PR and confirm it selects full; verify one Ubuntu 8x, one macOS 12x, and one Windows 32x test job run and CI Gate passes.
2. Run python3 -m unittest tests.test_ci_policy tests.test_doctest_packages tests.test_test_performance; expect all policy and helper tests to pass, including docs-only and post-merge skip behavior.
3. Run actionlint against .github/workflows/ci.yml and .github/workflows/runner-sizing.yml; expect both workflows to validate.
4. For the regression path, change a simulated required result in a gate_errors test from its expected success or skip value and confirm the aggregate gate test fails.