ci: add universal PR Gate required status check

[joshua-temple]

Problem

The PR Validation workflow had a workflow-level paths-ignore for docs and config files. On a docs-only PR the entire workflow (Unit Tests + Lint) never ran, so those checks never reported. Requiring them in branch protection would permanently block any docs-only PR, since a required check that never reports can't be satisfied.

Change

Restructure so the workflow triggers on every PR to main and add a single aggregate gate:

• Removed the workflow-level paths-ignore. The workflow now runs on all PRs to main.
• Added a changes job using SHA-pinned dorny/paths-filter to detect whether non-docs (code) files changed.
• Gated the expensive Unit Tests and Lint jobs on needs.changes.outputs.code == 'true', so they skip on docs-only PRs but keep their existing behavior otherwise.
• Added a final PR Gate job (needs: [unit-tests, lint], if: always()) that passes when each gated job succeeds or is skipped, and fails when any failed or was cancelled.

Resolution

• Docs-only PR: expensive jobs skip, PR Gate reports green.
• Code PR that passes: jobs run and succeed, PR Gate reports green.
• Code PR with a failing check: PR Gate reports red.

Branch protection

Require the single check named PR Gate. It reports on every PR, so docs-only PRs are no longer locked out, while real failures still block.