ci: contain narrow python test silos

[lmeyerov]

Summary

Third slice for #1689, stacked on #1691. This is the first behavior-changing slice and is intentionally conservative:

• add networkx_test_only, docs_test_only, benchmarks_only, and aggregate narrow_python_only
• keep unknown Python edits fail-closed with python && narrow_python_only != true
• keep shared/core/tooling paths fanout via core / infra
• carve out known narrow Python cases from unrelated GFQL/pandas/DGL/docs/schema gates

For the #1686 shape (CHANGELOG.md + graphistry/tests/plugins/test_networkx.py), the modified gates select the networkx policy job and skip unrelated GFQL/pandas/DGL/docs/schema gates.

Why

The target overrun happened because a plugin test-only Python edit made python=true, and heavy jobs treated python as sufficient. This PR preserves conservative behavior for ambiguous Python edits while containing known narrow silos.

Validation

• bash -n on the expanded changes shell block
• git diff --check
• gate scenario dry-runs parsed emit / emit_only regex blocks from ci.yml
• scenarios covered: PR fix(test): networkx HITS test used a degenerate cycle graph (scipy-version flaky) #1686, docs test support, benchmark-only harness, workflow infra, unknown Python fail-closed, and core PlotterBase.py

Residual risk

GitHub Actions needs skip behavior should be confirmed in CI. Follow-up PRs can address trickier hidden fanout and changed-line coverage artifact dependencies.

Stack: 3/3. Previous: #1691.