C3: move the seven non-blocking ci.yml jobs off the pull-request path to the night run #2170

Row C3 of docs/specifications/sub/release-v0.1.619-plan.md (epic #2124). It is the remainder of #2119.

The required set on main is gate and workspace-test, and gate has no needs:. Seven ci.yml jobs run on every pull request but cannot block it: kani, lake-build, docs, wasi, lean-models, shader-validate and license-scan. Under the two-state rule, a check that cannot block is a night check.

Change: those seven jobs leave the pull-request path and run only on the nightly schedule: and on workflow_dispatch, which #2167 (C2) adds. A red there opens or updates one issue with one owner. gate and workspace-test do not change. No check is added to or removed from the required set.

done_when: a falsifier test reads ci.yml and fails if any of the seven can run on pull_request or push, if gate or workspace-test lose those triggers, or if a continue-on-error step stays on the pull-request path. It is shown RED on the unchanged tree. After merge, the first PR run shows only the required jobs, and the first night run shows all seven (recorded on #2124).

Depends on #2167 for the nightly trigger.