ci: stop running the whole pipeline on markdown-only changes

[cryptskii]

The waste, measured

A 17-line markdown diff (#824) burned 95 minutes of runner time:

job	time
Coverage	52m20s
Rust	23m53s
Docker	6m02s
Storage Node (Postgres)	4m17s
Formal Validation	2m36s
the rest	~6m

Coverage was not anomalous at that length. Recent runs took 52, 45, 48 and 52 minutes. It is simply the longest job in the pipeline, and it ran to completion on a change it cannot be affected by.

Cause: every workflow triggers on pull_request with no path filter and no job-level condition, so every job runs on every PR regardless of what changed.

Verified before filtering, not assumed

• No markdown is compiled in. Zero include_str!("*.md") anywhere in the tree.
• Every gate that scans the tree already excludes markdown: --glob '!**/*.md' in no_clock_and_no_json.sh and bridge_contracts_gate.sh, --exclude='*.md' in check_forbidden_symbols.sh.
• No status check is required to merge. The main-branch-protect ruleset requires deletion protection, non-fast-forward, a reviewed PR and signed commits — and no status checks at all.

That last point is the one that makes this safe. The usual trap with paths-ignore is a required check that never reports, leaving a PR permanently unmergeable. That cannot happen here.

Scope of the filter

Only '**/*.md'. docs/ also holds a JSON, a TeX source and two PDFs, and those still run the full pipeline — "it lives under docs/" is not evidence that nothing consumes it.

Mixed PRs are unaffected: paths-ignore only skips when every changed file matches, so a PR touching code and docs together still runs everything.

CodeQL's schedule and workflow_dispatch runs are deliberately not filtered and remain the full-tree scans. The PR filter is consistent with that file's own note that alerts are already restricted to the PR diff, so a markdown-only PR reports nothing by construction.

Verification

Both files were parsed after editing to confirm the triggers are still well-formed: ci.yml 11 jobs, codeql.yml 1 job, filters on push and pull_request only.

This PR changes YAML rather than markdown, so it exercises the full pipeline itself.