fix(ci): scope .github/workflows path filter to ci.yml; remove echo web-lint stub

[sabbour]

Problem

Two independent sources of CI waste in ci.yml.

1. The path filter escalated on every workflow file

All five changes filter groups included:

- '.github/workflows/**'

The intent was "a change to this pipeline must fully verify it". The effect was that
editing any workflow in the repo -- agent-host-maintenance.yml, docs-drift.yml,
publish-images.yml, squad-*.yml, deploy-docs.yml -- tripped all five groups and
ran the entire matrix.

#899 proved it: a workflow description-only edit ran .NET tests, Web tests,
Node toolchain tests, Docs build and Architecture diagrams. None of those
workflows drive any of these suites.

2. Web lint was an echo-only stub

- name: Confirm co-located lint passed
  run: echo "Web lint passed in the Web tests job."

Introduced in #743 to preserve the branch-protection check name after lint moved into
Web tests. It could never fail, and GitHub bills every job a full minute:
282 billed minutes across 230 runs in August for one echo.

Change

• Every filter group now escalates on .github/workflows/ci.yml only. A change to
  ci.yml still trips all five groups, so the pipeline is never under-verified when it
  changes.
• areasForPaths() in scripts/ci/validate.mjs carried the identical
  .github/workflows/ prefix rule for local validation. Both classifiers state the
  same policy, so both are scoped to ci.yml -- otherwise they drift.
• web-lint job deleted. Lint coverage is unchanged: it still runs inside
  Web tests via validate.mjs --area web.
• Docs updated: CONTRIBUTING.md (job table, "six" -> "five" blocking jobs),
  .github/dev-branch-protection.md, .github/main-branch-protection.md,
  .copilot/skills/agentweaver-git-workflow/SKILL.md.

Regression tests

Added to scripts/ci/tests/ui-harness-workflow.test.mjs:

• path filters escalate on ci.yml only, never on every workflow file -- asserts no
  .github/workflows/** glob survives and that all 5 groups still list ci.yml.
• no echo-only stub jobs remain in the pipeline.

Extended scripts/ci/tests/shared-deps.test.mjs to assert docs-drift.yml and
publish-images.yml select no validation areas.

node --test scripts/ci/tests/ui-harness-workflow.test.mjs scripts/ci/tests/shared-deps.test.mjs
# tests 23 | pass 23 | fail 0

npm run version:check and npm run changeset:check -- --base origin/dev both pass.

Ruleset change already applied

Web lint was a required status check on dev-integration-ruleset. Deleting the
job without removing the check would have blocked every PR on a check that never reports --
including this one. It has been removed via the API before this PR:

.NET tests / Node toolchain tests / Web tests / Docs build / Changeset advisory

main-ruleset never required Web lint; it is unchanged. No other ruleset field was
modified -- enforcement, conditions and PR rules verified intact after the update.

Safety

No protection is lost.

• Every remaining required check is unchanged and still blocking.
• The only removed check was a tautology that could not fail.
• Skipped jobs still count as passing for rulesets, so the narrower filter cannot block a
  merge; it only avoids running suites the diff cannot affect.
• Editing ci.yml itself still runs everything.

Expected saving

• Web lint: ~282 billed min/month, eliminated outright.
• Path filter: every workflow-only PR previously bought a full matrix (~14 billed min).
  Workflow edits are frequent here -- fix(ci): use GHCR instead of ACR in agent-host-maintenance workflow #896 and Update ACR description to GHCR in workflow #899 are both recent examples.

[sabbour]

Note on base branch

This PR was opened against dev, but a concurrent session stacked its Dependabot work
(#901) underneath this branch and stacked #902 on top of it. Rather than force-push and
break #902's history, this PR has been retargeted onto its stack parent
fix/dependabot-rebase-strategy (#901), which is the standard stacked-PR resolution.

The diff is now exactly the nine files belonging to this change:

.changeset/ci-path-filter-and-web-lint.md
.copilot/skills/agentweaver-git-workflow/SKILL.md
.github/dev-branch-protection.md
.github/main-branch-protection.md
.github/workflows/ci.yml
CONTRIBUTING.md
scripts/ci/tests/shared-deps.test.mjs
scripts/ci/tests/ui-harness-workflow.test.mjs
scripts/ci/validate.mjs

Merge order: #901 -> #903 -> #902. GitHub retargets this PR to dev automatically
when #901 merges.

Verification

CI run 32847554833
completed success on all seven jobs (.NET tests, Web tests,
Node toolchain tests, Docs build, Architecture diagrams are in sync,
Changeset advisory, Detect changed paths).

Web lint no longer appears in the check rollup, confirming both the job removal and
the ruleset update took effect without blocking the PR.

Every suite ran on this PR, which is the correct behaviour: this PR edits
.github/workflows/ci.yml itself, and all five filter groups still escalate on that file.