toolkit merge: per-product CI with changed-file gating

[BYK]

Sub-task of the toolkit monorepo merge (master issue linked below). Plan: https://gist.github.com/BYK/8c0ce6cec64608f41fe5654b7827228e

Port CI workflows with changed-package gating.

• test.yml uses scripts/ci-projects.mjs to discover affected CLI, CLI-docs, and MCP workspaces, build their dependencies, and run their configured checks. This replaced the proposed separate product workflows and dorny/paths-filter.
• cli-build.yml builds five platform binaries, npm packages, and docs; it publishes Toolkit GHCR nightlies on main (Toolkit #1393).
• The required test job accepts skipped project/runtime jobs only when the discovered count is zero.
• Decide whether the MCP deploy needs a product path filter. Current deploy.yml runs on a successful Test push for current main; changing this safety/provenance gate needs separate review.

See §4.

[BYK]

Master tracking issue: #1248