[Build] Scope protobuf integrity checks to generator inputs

[stephenlclarke]

Problem

A dependency-pin-only PR currently runs the full protobuf integrity step even when no protobuf schema, generated source, generator dependency, or protobuf build script changed.

Evidence: PR #252 changes only the Containerization revision in Package.swift and Package.resolved, yet workflow run 34419904872 spent approximately 9 minutes 32 seconds in Check protobuf before beginning the project build. The earlier 0.14.3 refresh observed the same step taking over ten minutes.

Required behaviour

Classify the complete set of protobuf integrity inputs explicitly and run the expensive check only when one of those inputs changes. The classifier must fail closed when it cannot establish the comparison base or when its input contract is incomplete. Ordinary dependency pins that cannot affect generated protobuf output should skip the step.

Acceptance criteria

• Changes to schemas, checked-in generated sources, generator scripts, generator toolchain pins, or the classifier itself run the protobuf check.
• A Containerization-only revision update skips it.
• Push, pull-request, merge-queue, and release contexts use an authoritative comparison base.
• Focused classifier tests cover positive, negative, and unavailable-base cases.
• CI reports the selected path class and reason.