Select affected Cloud integration suites

[sdairs]

Closes #406

Summary

• add a secretless planning job that classifies the exact captured PR base-to-head diff
• run only affected service, Postgres, organization, and ClickPipes suites while failing closed to all
• skip the environment-bearing job for explicitly mapped no-suite changes
• cover additions, modifications, deletions, renames, copies, unknown paths, and complete source/test inventories

Verification

• classifier tests: 14 passed
• complete scripts test suite: 26 passed
• YAML parsing
• zizmor: no findings
• git diff check

Rebased onto main after the API and CLI modularization stack merged.

[sdairs]

Closing and removing this from the active stack for now. We will reopen/restack it after the current stack merges.

[sdairs]

Superseded by #413, rebased onto main as a standalone PR.