Make CI checks safe to require on main

[Paladin173]

What changed

Preparation for making CI checks required on main. GitHub reports a skipped
required status check as pending forever, so a docs-only pull request would have
hung and never become mergeable under the previous shape.

• unit-tests, android-lint, and debug-build no longer skip at the job
  level. They always run and always report a conclusion; on a documentation-only
  change set each individual step short-circuits instead, so the checks still go
  green in seconds without compiling anything.
• docs-render is now unconditional for the same reason. It scans the whole tree
  in about four seconds, so gating it on changed paths bought nothing and made it
  unsafe to require.
• docs-links stays conditional and continue-on-error. It depends on the
  network and is not a merge gate.

Two contract tests enforce the shape so it cannot regress:

• Every step in the three Gradle jobs must carry a docs_only guard, and none of
  the three may skip at the job level.
• Any job named as a required-check candidate must have no condition other than
  always().

Testing

• python -m unittest discover -s tools/tests -p 'test_*.py' — 47 passed.
• Confirmed the workflow parses and that the seven intended required checks now
  have either no condition or ${{ always() }}, while docs-links and
  android-ui-smoke remain conditional and unrequired.
• No Android source or Gradle inputs changed, so Gradle verification was not
  re-run.

Follow-up

Once this lands, the main ruleset will require: docs-render,
release-tooling-tests, webui-script-syntax, webui-script-lint,
unit-tests, android-lint, and debug-build.