ci: fast lanes for docs-only PRs, 6-way serial sharding, flake retry

[pruge]

Three independent CI speedups for .github/workflows/ci.yml:

1. Docs-only fast path

New changes detect job (dorny/paths-filter@v3, pull requests only) with a two-filter expression: docs (*.md, docs/**, .agents/**) and other (** minus the doc surfaces). A PR gets the fast set only when detection succeeded and nothing outside the doc surfaces changed:

• Runs: Lint, Repo invariants (compatibility-pointers check included), plus a new standalone Documentation audiences test job (the serial shard that normally carries it skips).
• Skips: tests-portable-parallel-1/2, all tests-portable-serial-N, Behavior tests (Herdr), timing aggregate, coverage guard, macOS stock-Bash job.

Failure semantics: any non-success detection result (failure/cancel/skipped-on-push) routes every lane back to the full suite - an empty filter output can never silently green-light a skip.

Filter simulation against representative file sets (other decides heavy lanes):

Changed files	other	Result
this PR (ci.yml, bin/, docs/)	true	full suite
README.md + docs/x.md	false	fast path
.agents/**/SKILL.md + AGENTS.md	false	fast path
README.md + .tasks.toml	true	full suite
docs/x.md + tests/a.test.sh	true	full suite
.github/notes.md	true	full suite

All existing job names and ids are unchanged. Assumption noted inline: main has no branch protection (verified 2026-08-24), so skipped jobs cannot block merges; revisit before adding required checks. Pushes to main always run the full suite through the same rule (detection is skipped there).

2. Serial lane 4 -> 6 shards

PORTABLE_SERIAL_SHARDS=6 in bin/fm-test-run.sh; ci.yml matrix extended to [1..6] (still derives ofN from strategy.job-total, so drift fails loudly). Weight hints refreshed from the latest green run's fm-test-timing-portable-serial-* artifacts (32731658785, 2026-08-24: 126 scripts, 3062014 ms - nine of them then-unmerged scripts that are now measured ahead of landing). LPT result: six shards within 19 ms of each other (~8.4 min each vs ~10.6 min under 4-way), job cap tightened 20 -> 15 min keeping ~2x hang-tripwire margin. docs/fm-test-portable-shards.md records provenance, the new balance table, and timeout rationale.

3. One automatic retry per serial shard

The serial-shard run step re-runs the same shard exactly once on failure; passing on retry exits 0 and leaves ::warning:: annotations as flake evidence. No other step retries.

Verification

• bin/fm-test-run.sh --check-coverage: ok, total=156 parallel=24 serial=120 serial_shards=6 herdr=12
• tests/fm-test-run.test.sh: 18/18 ok
• tests/fm-documentation-audiences.test.sh: 3/3 ok (also fixed stale-classification fallout found on the older base)
• bin/fm-lint.sh: green (pinned ShellCheck 0.11.0, actionlint 1.7.12, 3 workflows valid)
• no-mistakes-required.yml untouched