ci: keep change verification lean - #47

Why

Each pull request repeats security and source checks and starts 1,080 fresh Erlang virtual machines.
Daily campaigns also repeat unchanged work.
The request-limit test races one-shot client cleanup with the server's error observation.

Changes

• Run change verification on pull requests and merge groups.
• Keep dependency auditing in the common gate and remove duplicated checks.
• Keep macOS, Windows, and OTP 28 and 29 tests.
• Move stability repetitions and SBOM generation to source-candidate.
• Keep fresh builds before artifact audits.
• Keep extended campaigns manual, with seven-day evidence retention.
• Remove the informational hosted soak job and keep the source-candidate soak gate.
• Make required accept exactly four successful job groups.
• Refresh testing guidance.
• Keep the request-limit client connection alive through the server's refusal.

Closes #46.
Qualification failures remain tracked in #40.

Validation

• mise run lint-repository, mise run dependency-audit, and mise run status-audit pass on Windows.
• mise run fresh-build and mise run fresh-build-audit pass on Windows.
• The workflow filter passes exhaustive jaq evaluation over 1,365 result arrays.
• Only the four-success array passes that evaluation.
• All 319 native HTTP/3 tests and 10 focused request-limit repetitions pass.
• Hosted run 39905366362 passes all seven jobs, including macOS, Windows, OTP 28 and 29, interoperability, and the common gate.
• Full release campaigns haven't run for this configuration change.

@coderabbitai ignore