feat(workflow): scope docker publishes to changed services

Add a preflight change-detection job to the Docker publish workflow and
derive the build matrix from shared-root and service-specific path
filters. Preserve full publishes on manual dispatch while skipping
unaffected service image builds on routine pushes.

.helloagents/archive/2026-04/202604160350_workflow-service-scoped-docker-builds/.status.json

@@ -0,0 +1 @@
+{"status":"completed","completed":4,"failed":0,"pending":0,"total":4,"done":4,"percent":100,"current":"Completed - docker publish workflow now builds only impacted services","updated_at":"2026-04-16 03:58:00"}