feat(ci): add aggregate merge-gate workflow

Replace 7 explicit required status checks with a single aggregate
merge-gate workflow. Each gating check has a real + skip job pair
controlled by path classification, and a final gate job aggregates
all results.

Gating set: qualification (Test/Lint/CLI E2E/E2E/Security Scan),
CodeQL, vuln-scan, malware-scan, actionlint, verify-licenses.
GPU tests remain advisory until flake rate is assessed.

Deletes docs-only.yaml and docs-only-checks.yaml — the merge-gate
handles docs-only PRs natively via skip jobs.

Fixes #605
Related to #559