fix(ci): required checks must always report (#53 follow-up)

[w4ffl35]

Follow-up to #53. Platform finding: a ruleset does not treat a skipped job as a satisfied required check — leaf-only PR #54 came back BLOCKED with changes and leaf green and the twelve heavy jobs skipping.

Fix

• The five required jobs (lint, test (3.12), core-boundary, published-surfaces, packaging-guards) now always run.
• Only the seven non-required heavy jobs (test-deploy, hub, extras, blocked-deps, docs, client, headless) skip on a leaf change.
• test keeps needs: changes and narrows its matrix to 3.12 when leaf, so the required test (3.12) still reports while three cells are cut.
• The leaf job remains a fast extra signal; it is not required (ruleset reverted to its original five — verified bypass_actors: [], enforcement: active).

Why this shape

Per-path required checks are not expressible in a ruleset, so a fast lane cannot replace the required checks; it can only remove work that is not itself required. This keeps the gate honest (every required check still reports a real result) and still cuts 7 jobs plus 3 test cells on a leaf change.

Verification

• YAML parses; required jobs have no if:; the seven non-required jobs keep the gate.
• Will be re-verified by re-running test(observability): pin the identifier-field shape (leaf-lane proof) #54's checks after this lands.

Refs Capsize-Games/hq#14

[w4ffl35]

§12.7 clause 8 record — temporary ruleset mutation to unblock this merge

(a) Owner approval: covered by the owner's standing approval for this wave on hq#14 ("apply §12.7 clause 8 in full") — recorded here as required.
(b) Recorded on this PR (this comment).
(c) Reverted immediately after the merge; (d) verified below.
Blocker: the ruleset (id 23571105), which this very PR fixes the interaction with; 0 failing checks, queued because it is a non-leaf change.
Compensating local run: YAML parses; required jobs carry no if; the seven non-required jobs keep the gate; test matrix expression validated.