fix(ci): report skipped required checks safely

[jeremi]

Summary

• preserve the four existing branch-protection context names with lightweight always-running result jobs
• run the expensive Rust, release-tooling, source-proof, and docs jobs only when their path classifiers require them
• fail closed if path classification fails, a required job fails, or a job result is inconsistent with the classifier
• add a regression test for the required context names and result contract

This removes the current failure mode where an intentionally skipped path-filtered job leaves an otherwise safe PR permanently blocked. It also avoids spending roughly an hour on unrelated build matrices.

Verification

• python3 -m unittest release/scripts/test_registry_release.py (65 passed)
• gate inventory plus release-tooling unit suites (110 passed)
• actionlint .github/workflows/ci.yml
• YAML parse
• git diff --check
• independent semantic review found no actionable issues

Signed-off-by: Jeremi Piotrowski [email protected]