Make the required CI gate fail closed

[jmcte]

Summary

• classify behavior, documentation-only, and unknown changes explicitly in the required PR gate
• run Fast Checks for source, tests, deployment configuration, runner images, local actions, dependencies, and fail-closed unknown paths
• keep same-repository and fork execution isolated while requiring the correct lane to succeed
• align extended validation and bootstrap metadata with the pnpm and Node 24 project baseline

Validation

• pnpm exec vitest run test/workflow.test.ts (14 tests passed)
• CI=true bash scripts/ci/run-fast-checks.sh (48 files, 268 tests; lint and build passed)
• actionlint (passed with known custom-runner-label diagnostics ignored)
• git diff --check

Synology / GitHub Impact

• no deploy impact
• compose/config change
• image rebuild or republish required
• GitHub settings or runner-group change required

The required CI Gate context remains stable. This changes what it accepts: dependency, behavior, deployment, and unclassified changes must now complete the appropriate Fast Checks lane. Draft PRs and explicitly documentation-only changes retain intentional skip handling.

Closes #148

[athena-omt]

Governance review: live head 0f8150e is fresh enough for review, required checks are green, and auto-merge is already enabled.

I reviewed the fail-closed CI gate classification for behavior/docs/unknown changes, same-repo vs fork job expectations, and the workflow/bootstrap contract tests. I did not find a blocker.