ci: run core Python checks on pull requests

[zenithruneblade]

The existing Repository Checks workflow is manual-only because its full suite includes unresolved host-runner differences. Add automatic core Python checks for pull requests and pushes to main without requiring a container daemon, real database, systemd service, model or GPU.

• Add make test-ci with an explicit core selection; retain the full make test/make check defaults and the separate container profile.
• Run repository lint, formatting and types before the selected tests. Static analysis installs the existing optional container-test Python dependencies because it checks those test modules; it does not execute container tests. Use read-only workflow permissions and cancel superseded runs.
• Keep full qualification manual and make its documentation job reachable on manual dispatch. Align CONTRIBUTING and the quality/testing ADRs with the actual profiles.

Validation

• Core selection: 1,340 passed, 5 warnings, in 13.80s locally. Sandbox execution stalled at an async agent test; the unchanged selection passed outside that sandbox.
• Ruff lint and formatting: passed. BasedPyright: zero errors/warnings.
• Architecture checks: 19 passed. Clean Zensical build and workflow YAML parsing: passed.
• GitHub-hosted execution: passed on the current head, including lint/format/types and 1,340 tests. Container, live-host, frontend and real-model qualification were not run for this change; the automated core selection does not claim those boundaries.

The branch includes only six CI/configuration/documentation files; unrelated working-tree documentation edits are excluded.