fix(ci): path-gate expensive CI jobs to cut Actions minutes

[Copilot]

CI ran all 10 jobs on every PR — 3 Windows jobs (2× billing), a 30-min devcontainer build, and 4 container install tests — regardless of what changed, which is the bulk of the ~4770 minutes/month spend.

Changes

• ci.yaml — new changes job: a ~30s ubuntu job diffs the PR against its base and emits windows / devcontainer / install outputs. Each heavy job gains an if: guard so it only runs when relevant files change. validate and test-bash-scripts still always run; a change to ci.yaml or workflow_dispatch runs everything.

  test-windows:
    needs: [validate, changes]
    if: needs.changes.outputs.windows == 'true'

  PR touches	Jobs beyond validate + changes + test-bash-scripts
  docs / renovate.json / other workflows	none
  .devcontainer/** (e.g. digest bump)	test-devcontainer
  home/**, install scripts	devcontainer + Linux install jobs
  *.ps1, home/dot_config/powershell/**, tests/powershell/**	3 Windows jobs

• devcontainer-prebuild.yaml — concurrency: PR-only cancel-in-progress cancels superseded PR builds (amd64 + arm64 matrix); main/tag/schedule publish+attest runs are never cancelled.

• github-workflows-harden-runner.bats: bumped expected ci.yaml harden-runner count 2 → 3 for the new job.

Notes

Gated jobs report as skipped, which branch protection treats as a passing required check, so merges stay unblocked. Path filters mirror the existing base-ref git diff pattern already used by the lefthook step in the same workflow — no new action dependency.

• Fixes fix(ci): reduce workflow usage #603