[CI] Add changed-file scoped test selection with full-suite fallback

[utksh1]

Problem

SecuScan needs a production-grade improvement in this area: Faster reliable CI..

Scope

Map changed files to backend/frontend/plugin test subsets, run fast checks first, and fall back to full suite for shared files.

Acceptance Criteria

• The implementation is focused and does not introduce unrelated UI, docs, lockfile, or formatting churn.
• Security-sensitive behavior has explicit negative tests where applicable.
• Existing tests continue to pass, and new tests cover the main success and failure paths.
• Documentation or configuration examples are updated when operator behavior changes.

Verification

CI tests or dry-run output should prove mapping behavior for representative file changes.

Difficulty

Hard, useful issue intended for experienced contributors.

[divyansha12]

Hey @utksh1, GSSoC '26 contributor here, would love to be assigned this!
So right now every CI run executes the full suite regardless of what changed — a one line frontend fix still triggers backend and plugin tests. This issue wants a smarter selection layer that maps changed files to the relevant test subset and only falls back to full suite when something shared gets touched.
The hard part is getting the fallback condition right. A change in a shared utility could silently affect backend and plugin both so the mapping needs to be conservative there. I'd build the file to subset mapping as a config driven layer so it stays maintainable as the codebase grows and emit dry-run output showing exactly which subset got selected and why so CI behavior stays auditable.
Can you assign this to me?