ci: scope sample and test execution

[Picazsoo]

PR checklist

• Read the contribution guidelines.
• Run the following to build the project and update samples:

  ./mvnw clean package || exit
  ./bin/generate-samples.sh ./bin/configs/*.yaml || exit
  ./bin/utils/export_docs_generators.sh || exit
  

  (For Windows users, please run the script in WSL)
  Commit all changed files.
  This is important, as CI jobs will verify all generator outputs of your HEAD commit as it would merge with master.
  These must match the expectations made by your contribution.
  You may regenerate an individual generator by passing the relevant config(s) as an argument to the script, for example ./bin/generate-samples.sh bin/configs/java*.
  IMPORTANT: Do NOT purge/delete any folders/files (e.g. tests) when regenerating the samples as manually written tests may be removed.
• If your PR is targeting a particular programming language, @mention the technical committee members, so they are more likely to review the pull request.

---

Summary by cubic

Replaces hardcoded path filters in GitHub Actions and CircleCI with a shared CI scoping policy, so sample and test execution can be scoped to the files a PR touches. Shadow mode preserves the existing full runs while logging what would be filtered, giving maintainers a way to validate the new calculation before switching to enforce mode.

• The scope manifest lives in CI/change-scopes.json and is validated by .github/.test/ci-scopes.js.
• A new compute-matrix action reads the manifest and reports the affected matrix, sample paths, and decision reasons per suite.
• Each workflow adds a setup job to compute changes and gates its build/test job on that result.
• Workflows gain workflow_dispatch and consistent branch filters for master and maintenance branches.
• The test-results workflow now inspects the unit test outcome and publishes only when that job actually ran.

^{Written for commit 072a3ba. Summary will update on new commits.}