Enable QueryVault CD and isolated pull-request CI

[stevewittek]

Summary

• retain manual production dispatch and add automatic deployment for pushes to master limited to QueryVault/**
• keep production on the protected queryvault-production environment, non-canceling concurrency group, and all five Voyager2 runner labels
• add pull-request-only static validation on ubuntu-latest, with no self-hosted runner, production environment, SQL credential, remote host, or database access
• update deployment and validation documentation to reflect completed Voyager2 and SQL Server 2022+ validation while preserving genuine unfinished work

Production evidence

The authorized current-master deployment succeeded before this branch was created: https://github.com/stevewittek/Databases/actions/runs/33803899971

• pre-deployment verification: passed
• new copy-only checksummed backup: created and verified
• existing tables and archive data: preserved
• SQL Agent jobs changed: 0
• post-deployment verification: passed

Validation

• dashboard JSON parsing: PASS
• workflow and provisioning YAML parsing: PASS
• production/CD and PR-CI policy assertions: PASS
• stale deployment/validation status scan: PASS
• PowerShell repository contracts and parser checks: run by the new GitHub-hosted PR job

This PR must not be merged without explicit approval.