Keep local install workflow triggers aligned

[sdairs]

Summary

• expand the live install workflow path filter to the current ClickHouse installer dependency surface
• keep unrelated local Docker/Postgres sources and tests outside the expensive matrix
• add a fail-closed classifier and static workflow mapping coverage in install and broad CLI CI

Tests

• python3 -m unittest discover -s scripts/tests -p 'test_*.py'\n- python3 scripts/tests/test_classify_install_integration.py\n- Ruby YAML parse of .github/workflows/test-install.yml and .github/workflows/test-cli.yml\n- classifier smoke checks for run, skip, and unknown fail-closed paths\n\nCloses Keep local install integration workflow triggers aligned with installer dependencies #461

[sdairs]

Carry-over review from PR #512 (old PR for #461). This PR is preferred over #512 and is approved on its own merits (meets all four acceptance criteria; CI fully green including the install matrix). No sdairs review comments existed on #512. For completeness, reasons this PR wins over #512, plus minor items:

Why preferred over #512:

• Keep local install workflow triggers aligned #512's inventory listed paths that don't exist in either tree (.cargo/config, .cargo/config.toml, rust-toolchain, rust-toolchain.toml) and had an internal inconsistency (telemetry.rs NO_INSTALL but telemetry_test.rs INSTALL). This PR's inventory matches its actual tree.
• This PR's version_manager/** glob absorbs file renames (e.g. lock.rs → atomic.rs between stack bases) without mapping churn, whereas Keep local install workflow triggers aligned #512's no-glob exact mapping makes every rename a fail-closed CI break requiring a mapping edit.
• Keep local install workflow triggers aligned #512's CI is red (from its stacked base, not its own diff); this PR is green.

Minor items (optional follow-ups):

1. The argparse CLI (main()/classify_paths() in scripts/classify-install-integration.py:~114-128) is never invoked by any workflow in this diff — currently dead code. It matches the classify-cloud-integration.py convention, so keep it if it will be wired up, otherwise note it is reserved for future use.
2. The inventory test only globs *.rs; non-.rs files under tests/ (future snapshots) aren't covered. Keep local install workflow triggers aligned #512 inventoried all files. Consider broadening if snapshot tests land.
3. Unlike Keep local install workflow triggers aligned #512, no test pins the exact install/no-install mapping sets — a file could be moved between INSTALL_EXACT_PATHS and NON_INSTALL_EXACT_PATHS and only the workflow-equality test would catch it (it would, but less review-visible). Consider pinning the sets.