ci: one CI workflow with a single required check

[datlechin]

Summary

• New .github/workflows/ci.yml: runs on every PR, on pushes to main and release/**, and by dispatch, with no paths filter. A dispatch has no base and runs every suite.
• One Plan job runs detect-changed-paths.sh once per suite. It replaces the Changes jobs in macOS Tests, iOS and Package Tests and Build Linux, and the hana step in Repo Hygiene.
• Plan's base on a main push is the head SHA of the last successful CI push run on main, not github.event.before. No such run, or one on HEAD, runs everything. release/** still runs every suite through --ref, except Linux: the linux call skips on release/**, since Linux ships from main or linux-X.Y.
• macos-tests.yml, ios-tests.yml, swiftlint.yml, repo-hygiene.yml and build-linux.yml are now workflow_call only. plugins, oracle, hana and docs-only are inputs. build-linux.yml keeps its nightly schedule and dispatch. Flatpak and MSRV run only there (github.workflow == 'Build Linux'), never from CI.
• The CI job (if: always()) needs every called job. It fails on any failure or cancelled result. A skipped job passes. The Linux gate job is gone.
• Concurrency lives only in ci.yml. A PR cancels its older run. main has one group per ref with no cancel, so a newer pending run replaces the older one. Each release/** commit and each dispatch gets its own group.
• Detector: ci.yml is in every suite but shipped. New suite swiftlint (*.swift, .swiftlint.yml). New suite linux-docs for the Documentation links job, which is its own job again. linux now skips Markdown, except linux/CHANGELOG.md, linux/docs/regression-tests.md and linux/data/, since Meson tests and the build read those.
• zizmor in Supply chain also audits ci.yml.
• version.py check reads the tag commit's CI push run on release/X.Y. The run must be completed with success, and macos / macOS Tests and ios / iOS and Package Tests must each be success, not skipped or missing. test_version.py is updated to match.
• .claude/rules/ci.md cut from 19 KB to about 4 KB: required checks, reading a red check, what runs where, detector suites, runners, Release Build, caches.
• These docs now point to ci.md instead of naming the old checks: CONTRIBUTING.md, apple/RELEASING.md, plugin-system.md, the release skill's run query, linux/docs/testing.md and linux/CONTRIBUTING.md.
• The old required contexts stop reporting on main once this lands. This PR needs an admin merge, then the ruleset swap to CI and PR title.

Test plan

• python3 -m unittest scripts/ci/test_detect_changed_paths.py: new cases for Markdown-only Linux changes, the Markdown that Linux tests read, the swiftlint and linux-docs suites, and ci.yml in every suite.
• apple/scripts/release/test_version.py on Python 3.9: a skipped, missing or failed test job, a run still in progress or red, and a run of another workflow each refuse the tag.
• Every Repo Hygiene tooling test passes locally, and so does the towncrier draft.
• actionlint (shellcheck at warning), shellcheck --severity=warning and zizmor --offline --min-severity=medium on ci.yml and the Linux workflows: clean.
• Aggregator proof: a throwaway commit made SwiftLint exit 1, and a revert commit followed. Run URLs are in a comment below.

[datlechin]

Aggregator proof:

• Red: https://github.com/TableProApp/TablePro/actions/runs/39294393423 (b651e86, SwiftLint exits 1 on purpose). Every other job passed and CI failed.
• Green: https://github.com/TableProApp/TablePro/actions/runs/39303475958 (74bdf16, after the revert and a merge of main). Every job passed and so did CI.