ci: de-duplicate invariant gates across the test matrix

[codeforester]

Fixes #312

Summary

• Keep the complete OS/Python runtime suite in the compatibility matrix, while running coverage, typing, lint, docs/contracts, benchmark, and security gates once in the quality job.
• Split tests/full_validate.sh into named, reusable gate groups while preserving its no-argument local aggregate and result-file behavior.
• Limit Tests workflow push runs to main and version tags; feature branches are validated by their pull-request run instead of a duplicate push run.
• Keep Package workflow focused on build, artifact, metadata, and installed-wheel release-boundary checks.

Validation

• ./tests/full_validate.sh: 526 passed, 193 subtests passed, 87.20% total coverage; typing, Ruff, docs/schema/contracts, benchmark budget, Bandit, and pip-audit all passed.
• ./tests/full_validate.sh --gate runtime: 526 passed, 193 subtests passed.
• Both changed workflow files parse as YAML; git diff --check passed.

Hosted timing baseline

Before-change successful Tests runs on main (four runs, each 19 jobs) had median total job time of 29.3 minutes and median workflow wall time of 7.1 minutes. I will update this PR with the corresponding post-change hosted measurements once its jobs complete. No PRs in this train are being merged.