Fix a required-status-check deadlock by converting the path-filtered required job to a **pass-through shim** (same pattern as echidna#256).

## Why
This job is a **required** status check but its workflow is path-filtered on `pull_request`, so it never runs (never reports) on PRs that don't touch those paths — branch protection then waits forever and the PR can't merge via normal flow.

## Fix
- Drop the `pull_request` paths-filter so the job **always runs** (the required check always reports).
- A `Detect relevant changes` step reads the PR's changed files via the GitHub API and gates the heavy steps — real work runs only when the relevant sources change; otherwise it passes through in seconds.
- `push` stays scoped to the default branch + paths (post-merge behaviour unchanged); job names preserved so the required contexts still match.

Identified by the 2026-06-14 estate required-check deadlock audit (`dev-notes/audits/`).

🤖 Generated with [Claude Code](https://claude.com/claude-code)