ci: reorganize checks by capability, dependency, and human-readable reporting

[Teakowa]

Implements #207.

Summary

Replaces the flat, milestone-named CI structure (anchored around v1-gates) with 9 capability-oriented jobs in a dependency-aware DAG.

Job changes

Old name	New name / disposition	What it proves
rust-quality	rust-quality (unchanged)	Rust fmt, clippy, workspace tests
v1-gates	removed — split below	—
↳ compatibility evidence	→ opy-integration	Wright N-level gate vs recorded OPY snapshots
↳ scenario runner	→ scenario-validation	Compile-time WIR/emission scenario contracts
↳ benchmarks	→ benchmark	Performance evidence artifact
compatibility-differential	→ opy-integration	Native-vs-reference OPY differential
ostw-compile-differential	del-integration	Wright OSTW/del-rs forward-compilation contract
lpp-client-integration	lpp-integration	LPP client protocol contract
cli-github-actions-smoke	cli-behavior	CLI GHA renderer integration
adapter	opy-adapter	OverPy-to-HIR TypeScript adapter
dist-validation	dist-validation (gated)	Cross-platform distribution smoke

DAG dependency structure

paths
├── rust-quality (stable + 1.85.0 matrix)
│   ├── opy-integration (N-level + differential)  ──┐
│   ├── del-integration (OSTW differential)          │
│   ├── lpp-integration (mock provider)           ──┤─→ dist-validation
│   ├── cli-behavior (GHA smoke)                     │
│   ├── scenario-validation (scenario runner)         │
│   └── benchmark (perf evidence)                    │
└── opy-adapter (TypeScript, independent)

dist-validation only runs after rust-quality, opy-integration, and lpp-integration all succeed — preventing three cross-platform runners from consuming time when foundational gates have already failed.

PR path filters

A new paths job computes conservative filters. Broad/core changes (Cargo, src/, scripts/, CI) expand all checks. Narrow changes (adapter/, dist/) run only the relevant job. Push to main runs everything unconditionally.

GITHUB_STEP_SUMMARY

opy-integration, del-integration, scenario-validation, and benchmark write concise Markdown summaries derived from their JSON reports. Summaries show PASS/FAIL, totals, and per-failure detail. When dist-validation is skipped due to upstream failure, the summary explicitly names which gate caused the skip.

Machine-readable JSON artifacts are preserved for all reporting jobs.

Acceptance criteria check

• No v1-gates/release-phase bucket; contents assigned to capability jobs or removed with evidence
• Retained checks prove named Wright-owned contracts or consume owning-repo contracts
• Fundamental failures prevent dist-validation from wasting runner time
• Independent capability checks still run in parallel
• PR path filters select relevant checks; broad changes expand appropriately
• main push bypasses filters for full convergence coverage
• Capability jobs write concise GITHUB_STEP_SUMMARY from test results
• JSON reports retained as artifacts
• Summary generation derives from test/report results (no hand-authored second source)
• Branch protection: main is currently unprotected by required status checks, so no migration risk; note in PR for maintainer review
• Job names describe what each check proves without historical milestone terminology