ci: scope docs-only skipping to jobs, so required checks still report

[efiten]

Replaces the trigger-level paths-ignore from #1949 and #1950. That approach was wrong, and it is currently blocking #1953 from merging.

What was wrong

GitHub documents the distinction I had backwards:

a workflow skipped by path filtering keeps its checks pending and blocks the merge, while a job skipped by an if: conditional reports Success and does not.

So the filtering has to live on the jobs, not on the trigger.

I compounded it by claiming, in both the commit and the description of #1949, that master had no required checks: "verified: the branch protection endpoint returns 404". That verification was invalid. A 404 there means the token cannot read protection details, not that none exist. The branch reports protected=true, and #1953 was refused with the base branch policy prohibits the merge.

I wrote the trap into that workflow as a comment and then walked into it, because I had established the precondition wrongly.

What this does

A 🔎 Change scope job computes whether anything outside docs/, *.md and LICENSE changed. go-test, e2e-test, build-and-publish and release-artifacts are gated on its output. A documentation-only pull request skips those jobs, they report Success, and the PR can merge.

Only pull requests are scoped. A push or a dispatch always runs the full pipeline.

That second part is deliberate and it fixes today's other failure. release-fast-path.yml re-tags :edge to :vX.Y.Z only when the :edge revision label matches the tagged commit. A master commit with no image breaks tagging, which is precisely what happened to the v3.10.0 tag, where the tagged commit was documentation-only: the fast path could not re-tag, fell back to a dispatch, and the dispatch published nothing (#1951).

Master pushes now always produce an image. The cost is running the pipeline on documentation commits to master. Pull requests are where the queue pressure actually was: a pull_request run created at 12:13 did not start its first job until 16:19.

Two conservative defaults

In the scope check, a non-pull_request event and an empty diff both count as code. An unexpected shape runs everything rather than silently skipping.

Verification

The YAML parses, the trigger has no paths filter left, and the four gated jobs carry both needs: [..., changes] and the if:. The real proof is this PR itself: it changes only the workflow, so Change scope must resolve to code=true and the full pipeline must run.

[efiten]

Closing in favour of #1955, which carries the same change from a branch on this repository plus one fix.

This PR got no workflow run and no check suite at all. The cause was not a policy or the fork boundary, which is what I first suspected: the commit left two if: keys on the release-artifacts job, one pre-existing tag guard and one added by the gating pass. GitHub rejects a duplicate mapping key and refuses to load the entire workflow, so no run could be created. PyYAML accepts duplicates silently, last one wins, which is why local validation passed and I did not catch it.

Same content, corrected, in #1955.