Make pull-request CI change-aware and fail closed

[KimGLee]

Closes #119

Summary

• introduce a repository-owned, fail-closed impact planner for pull requests
• keep the stable ci-required branch-protection context while generating check and test matrices dynamically
• reduce total PR test work for documentation-only, direct-test, and bounded leaf-tool changes
• retain full Python 3.10/3.14 verification for shared authority, unknown impact, broad dependency closure, main pushes, and manual runs
• replace static Makefile shard targets with an explicit selected-test entry point

Verification modes

• checks-only: documentation-only changes run deterministic checks on Python 3.14 and skip unit-test jobs
• selective: changed test modules or bounded reverse dependency closures run only the affected test modules on Python 3.10 and 3.14
• full: shared CI/runtime authority, unknown paths, deletions/renames, broad closures, main pushes, and manual runs execute the complete suite on both Python versions

The planner rejects invalid or empty selections, validates full-suite coverage, and falls back to full verification whenever impact cannot be bounded safely.

Validation

• 15 planner/runner unit tests passed on Python 3.10.20 and Python 3.14.6
• deterministic make check passed on Python 3.10.20 and Python 3.14.6
• selected-test integration passed against real repository tests
• workflow YAML parsed successfully and Actionlint v1.7.12 passed
• staged diff and whitespace checks passed
• the actual PR diff resolves to full because it changes CI authority, so remote CI will exercise the complete fallback path

The exhaustive three-cache-state workflow was not run locally; it remains available as the manual deep-verification workflow.

Scope

This PR changes four files: the impact planner, the verification workflow, the Makefile test entry point, and focused planner tests. It does not change product/runtime behavior or the public Tools CLI/MCP inventory.