ci(workflows): enforce dependency-aware selection and reusable workflow contracts

[jkim323]

PR validation can miss checks when shared dependencies, wrappers, workflow implementation, deleted files, or renamed inputs change. The CI architecture also lacks a declarative contract proving that event orchestrators remain thin, reusable workflows stay callable and focused, execution ownership is unambiguous, and mandatory jobs remain represented in the aggregate gate.

Implement dependency-aware check selection and structural workflow-contract validation without replacing the existing reusable-workflow architecture. Preserve the pr-validation-summary required-check context and all unconditional CPU smoke domains.

Acceptance Criteria

• Root Python configuration, shared fixtures, documentation content, workflow/action implementation, wrappers, Terraform inputs, provider locks, and shared image defaults select every affected consumer.
• Additions, modifications, deletions, and both sides of renames participate in selection; a Git comparison failure cannot become an empty successful selection.
• PR selection compares the event base SHA with the tested merge SHA; main continues full validation.
• pr-validation.yml and main.yml remain thin event orchestrators, while validation implementations remain focused workflow_call workflows.
• One declarative CI contract records lane classification, event ownership, reusable target or approved inline exception, selector, outcome schema, and permission profile.
• Structural validation rejects missing workflow_call, unresolved local calls, duplicate event ownership, inline duplication of owned validation logic, and mandatory jobs omitted from the aggregate gate.
• The advisory OSV lane remains explicitly advisory, and documentation deployment remains independent from main release evidence.
• Tests exercise the actual selector and parsed workflow graph, including root-lock-only, docs-only, wrapper-only, workflow-only, deleted/renamed input, verified-empty, and failed-comparison scenarios.

Scope

Reuse or extend existing workflow-reference, permission, interpolation, pinning, and credential-persistence controls. Do not introduce merge queue triggers, a new orchestrator, or repository-specific release machinery from another project.

Related

• Existing Terraform and Docusaurus baseline repairs: Fix Terraform diagnostic parsing and Docusaurus links breaking main CI #1625
• Superseded release/signing hardening: [Task]: Harden CI release and dependency validation #1091