ci: one risk-aware required quality check without duplicate backend runs

[yotamon]

Goal

Make the CI/CD pipeline safe to protect main with a single stable CI / quality status, without requiring heavy checks or non-applicable Firebase checks on every PR.

Changes

• CI / quality now runs for every pull request (including documentation-only) and push to main. Detect changed files before installing dependencies; on uncertain diffs fail open to all checks.
• Only run the relevant validations: changed-code lint/Vitest (frontend), Functions lint/build/Node tests (Functions), Firestore + Storage emulator tests (rules). Mixed changes run every relevant set.
• Share one pnpm workspace install for mixed app/Functions changes; avoid installing pnpm/node for documentation-only and avoid downloading Java/Firebase emulator tooling except on security-rule changes.
• Keep the standalone Functions QA and Firestore & Storage Rules QA workflows for manual runs, avoiding duplicate automatic runs.
• Preserve the manually triggered comprehensive full job, existing status check name quality, and concurrency cancellation. Do not create Vercel previews.
• Add unit tests for scope classification, including mixed, docs-only, backend-only, shared tooling, and unknown diffs.

Validation

• This PR deliberately modifies the main CI workflow so it runs all three relevant test families once, verifying wiring before a merge.
• No application behavior, Vercel settings, or Firebase releases changed.

Post-merge operations

A repo administrator should enable a minimal ruleset for main: PR required, required status quality (check presented as CI / quality), do not require branches to be up to date, no approval/review requirement for solo development. Do not require standalone path-scoped workflow checks, which would be absent on unrelated PRs.