feat(docs-only): make the docs-only verdict reachable from any workflow

[forkwright]

Unblocks thumos#775.

Finding

A workflow_call output is reachable only from jobs in the same file as the call. thumos's
kernel job lives in ci.yml while its gate call lives in gate-attestation.yml, so
hybrid-gate.yml's docs_only output cannot reach the job that needs it. thumos#775 is blocked on
that and nothing else.

@t0-thumos raised it and was explicit about the one thing that must not happen:

I am deliberately not implementing it locally: kernel is a required context, and a local
re-implementation that is ever wrong in the permissive direction reports success having built and
booted nothing. One shared implementation or none.

What changes

docs-only.yml — the verdict as a standalone reusable. Any workflow can now hang a
seconds-long preflight needs: off it.

hybrid-gate.yml calls it instead of keeping its own copy. That is the load-bearing half. A
second implementation of this verdict would decide whether a full build runs, so a copy that drifts
permissive reports success having built nothing — and two copies drift silently, because any given
repo exercises only one of them.

The step is moved byte-identically, extracted programmatically rather than retyped, so every WHY
it carries travels with it intact: three-dot vs two-dot ranges against a moving base, empty
github.base_ref on push events, and case-glob * spanning / so *.md already covers nested
paths.

The subtle part

docs-only is added to the needs: of both consumers, not merely referenced. needs.<job> is
undefined for a job you do not depend on, and the expression evaluates empty rather than
erroring.

Here that happens to fail safe — empty != 'true', so full-gate-build always runs — but it would
have disabled the docs-only exemption fleet-wide with nothing going red. A bug whose only symptom is
"the optimisation stopped working" is one nobody reports.

Verification

tests/docs-only.sh drives the classification against nine changesets:

== docs-only changesets ==
  pass  a single markdown file / nested markdown / docs tree / llms.txt   -> true
== anything else must build ==
  pass  one rust file among docs / a workflow change / a lockfile         -> false
== the conservative branches ==
  pass  empty changeset                                                   -> false
  pass  repo opted out of the exemption                                   -> false

Both conservative branches are tested deliberately. An empty diff must not be guessed as docs-only,
and a repo that opted out must produce an explicit false rather than an absent output a consumer
reads as empty — a caller wires this dependency unconditionally, so "skipped" is not available as an
answer.

shellcheck -s bash tests/docs-only.sh exits 0. This is the second such harness in the repo, after
tests/dependabot-auto-merge.sh — which caught two real bugs in its own fix before either reached a
runner, and is why this one was written before pushing rather than after.

Adoption

No caller change is required by this PR. A workflow that wants the verdict adds:

  docs-only:
    uses: forkwright/.github/.github/workflows/docs-only.yml@main

  expensive-job:
    needs: docs-only
    if: needs.docs-only.outputs.docs_only != 'true'

Note the != 'true' rather than == 'false': any value other than the literal string is
not-docs-only, which is the conservative direction and what the output's own description specifies.

Refs thumos#775.

[forkwright]

Scoped this down while it was in flight, and the reason is worth recording.

The original commit also repointed hybrid-gate.yml at the new reusable, so there would be one
implementation rather than two. That half rests on a question I had not established: whether
uses: ./.github/workflows/docs-only.yml inside a reusable that is itself called from another
repository resolves against this repo or against the caller's. This repo has no nested-reusable
precedent to read the answer off, and if it resolves caller-side it takes out the gate on every repo
that bumps its pin.

Two things make splitting clearly right rather than merely cautious:

• Callers pin hybrid-gate.yml by SHA, not @main — thumos's gate-attestation.yml pins
  @d74efb1d… # main. So nothing propagates on merge anyway, and the de-duplication can pin the SHA
  this PR produces, matching the convention already in use.
• The follow-up PR is where CI can prove the nesting works. A merge would only have discovered it.

So this PR is now purely additive: docs-only.yml plus its test, no change to any existing workflow.
It unblocks thumos#775 today at zero risk to the current gate.

The de-duplication follows immediately. Two implementations existing for one PR's width is a cost
worth paying to avoid guessing on a required context — and it does not stay that way.