test: harden changed validation ownership

[Pluze]

Goal and scope

• Goal: turn changed-path routing into explicit validation ownership and harden in-process App isolation.
• In scope: tri-state path classification, bounded system evidence, plan scope/artifacts, author reasons, dry-run explanation, CI docs/gate jobs, isolation restoration, documentation.
• Intentionally out of scope: historical test-parity reconstruction, coverage thresholds, dynamic dependency graphs, per-App MATLAB subprocesses, and repository branch-protection settings.

User-visible behavior

• Before: unknown changed paths widened to every automated environment.
• After: unknown paths fail planning; known framework/policy paths select bounded system evidence, and docs are explicitly owned by docsCheck.
• Compatibility / upgrade note: changedFast is intentionally stricter for unclassified paths.

Validation

• I ran the smallest relevant local validation from docs/development/maintain-and-release/testing.md.
• I ran the required final gate for this handoff.

Commands and results:

matlab -batch "addpath('tests'); results=runtests(...); assertSuccess(results);"  # focused planner/repository/isolation specs: passed\nmatlab -batch "buildtool('docs')"  # regenerated site\nmatlab -batch "buildtool('docsCheck')"  # passed\nmatlab -batch "buildtool('changedFast')"  # passed; 82 focused system identities\n```\n\nManual / native behavior not verified:\n\n- Native dialogs, pointer feel, and visual quality remain manual boundaries.\n\n## Documentation and boundaries\n\n- [x] Human docs were updated where public test-workflow behavior changed.\n- [x] Agent guidance was updated where execution and ownership rules changed.\n- [x] App-specific workflow logic stayed in the owning app.\n- [x] Reusable `+labkit` changes: none.\n\n## Delivery state\n\n- [x] The branch is committed and pushed.\n- [ ] Required GitHub checks are pending.\n\nCI / review links:\n\n- Pending on this PR. Repository branch protection has no configured ruleset; making `CI Gate` required remains an administrator setting.\n\n## Data hygiene\n\n- [x] This PR does not add raw lab files, identifying file names, subject names, device serials, local absolute paths, timestamps, or private experiment labels.\n\n## Unverified behavior\n\n- Cross-platform full profiles are pending CI.