[mache-0ca7e6] ci: make aggregate gates branch-protection-safe

[jamestexas]

Summary

• always start CI and integration workflows so required contexts cannot disappear behind path filters
• preserve docs-only cost avoidance with an explicit Git diff classifier
• emit stable CI required and Integration required aggregate checks
• require every applicable matrix/lint/drift job on code changes

Verification

• task lint:actions
• task lint:yaml
• task gates:preflight
• classifier identifies real docs-only commit 6449fd6 as light and this workflow change as heavy
• full pre-push task ci passed

After this PR merges, ruleset 12774157 will require only the two stable aggregate contexts.