Add path-aware native CI gates

[yyjeqhc]

Summary

• add trusted-base path-aware native CI classification for owner PRs while keeping push-to-main, external PRs, and run-ci on the full native matrix
• split macOS core vs Desktop/package coverage and preserve stable aggregate required checks (test, test-macos, test-windows, test-native)
• harden classification against body-only edits inside existing platform cfg / Cargo target sections, npm Windows installer changes, Runner-owned process surfaces, arbitrary workflow policy changes, renames/deletions, and bounded-input overflow
• keep first landing fail-safe: if the trusted base does not yet contain the classifier, run the full native matrix

Review follow-up

Independent review added 21033798 (Harden native CI path classification) after rebase onto current main. It closes false-negative cases for existing platform cfg context, nested Cargo target sections, npm/webcodex/**, Runner process owners, and new workflow files.

Validation

• python3 -m unittest scripts.tests.test_ci_path_risk — 25 passed
• bash scripts/test_python_tooling.sh — syntax-checked 26 Python files; 148 tests passed
• PyYAML parse of .github/workflows/ci.yml — passed
• git diff --check / staged check — passed
• real Git range classifier checks, rename fixture, platform-context and bounded-fallback regressions — passed
• worktree hygiene clean

actionlint passed in the implementation handoff. The fresh reviewer environment did not have actionlint on PATH; reviewer did not modify ci.yml after that handoff.