ci: skip test suites for markdown-only changes

[ajroetker]

Summary

A docs-only change currently runs the Zig base suite, the e2e base build, and (when it touches go/pkg/operator/) the operator suite, because nothing in change detection distinguishes markdown from code. #769 moved ~100 markdown files and ran all of those.

• zig-tests.yml: the changes job writes a change-filter script from an embedded heredoc into $RUNNER_TEMP and both the five changes blocks and the VOPR qualification block call it instead of git diff --quiet. It is embedded rather than checked in because the workflow runs from the default branch while the checkout is the PR head: an older branch without the file would otherwise make if ! script read as "no relevant changes" and skip all Zig validation. The VOPR step requires qualification if the helper is somehow absent. The filter drops .md/.mdx paths before deciding, with two exceptions that stay in scope: fixture READMEs under a testdata/ directory (the GLiNER2.5 oracle scripts check them) and a DOC_TEST_INPUTS allowlist, currently zig/pkg/inference/QUANT_KERNEL_COMPILER.md, which a Zig test reads directly. It diffs with --no-renames so renaming code to Markdown still counts, and a git failure selects tests rather than skipping them.
• pr-ci-config.json: the operator and proxy path patterns exclude markdown via a negative lookahead, so go/pkg/operator/work-log/*.md no longer selects the operator suite.
• scripts/ci/test_zig_validation_scope.py: the two existing pathspec tests parse the new invocation, plus eight new cases that extract the embedded filter from the workflow and run it in a temp repo: markdown-only, code change, testdata README, allowlisted doc, code-to-markdown rename, pathspec outside the change, bad base revision, and missing --.
• pr-ci.test.cjs: three assertions for the path patterns. pr-ci.cjs itself is unchanged.
• zig/CI.md: one bullet documenting the rule.

Suites with no path pattern (policy, zig, sdks) still dispatch; the Zig suite's inner changes job then skips its test jobs, and sdks-ci's own classifier already scopes by suffix. The result job already treats "changes selected nothing" as a pass rather than a failure.

Verification

• python3 -m unittest scripts/ci/test_zig_validation_scope.py: 10 pass.
• node --test .github/scripts/pr-ci.test.cjs: 83 pass.
• actionlint .github/workflows/zig-tests.yml: clean.
• The script against real commits: the docs: relocate implementation logs out of design docs #769 squash is relevant under zig/** (it edits a Zig and a Python comment) and not relevant under go/pkg/operator/** (markdown only).

Note

zig/CI.md asks that controller and test code stay identical across this repo and colony. pr-ci.cjs is untouched; the three new assertions in pr-ci.test.cjs sit inside the existing if (config.suites.some(s => s.id === 'zig')) branch, so colony's copy of the test file needs the same three lines to stay in sync.

[ajroetker]

/ci run bf1c6ef