fix(ci): make harness build selection testable and cover shared runtime changes

[reacher-z]

What does this PR do?

A change to runtime-server/server.py or its dependencies triggered the harness-build workflow but selected zero downstream harness images: the inline Bash selector still matched the obsolete extension-server/ directory. Extract dependency selection into scripts/ci/select_harness_builds.py and select all native harnesses for shared runtime-server, base, recorder, shared-data and registry changes.

Single-harness changes select only that harness. Deleted dependency paths participate in the diff; rename detection is disabled so moves across harnesses include both source and destination. Manual and workflow/selector-only runs exercise the full matrix. Harbor-only changes retain an empty native matrix, and the base image is still built by its separate job.

The workflow keeps Git revision validation and passes changed paths as NUL-delimited data. The helper owns matrix/count output and the readable summary. Both build and host-test workflows now trigger on selector changes. Includes the required Unreleased changelog entry.

Corpus

• v2
• v1
• both
• not applicable

Native harness CI dependency selection only.

Test plan

• 17 new tests covering shared dependencies, deleted files, registry changes, scoped/deduplicated selection, manual/selector changes, Harbor exclusion, and actual CLI matrix/count/summary output.
• Full suite: uv run --frozen pytest -q — 300 passed, 3 skipped.
• Repository-wide Ruff check and format check; Pyright over source, tests and the selector — no errors.
• Parsed the workflow and ran its actual selection shell step with stubbed Git diff inputs: runtime-server selects 12 images, Hermes selects 1, manual selects 12, Harbor-only selects 0. Shell syntax check passed.
• git diff --check.

No Docker image was built locally; this verifies build-plan selection and workflow plumbing. Shared runtime changes will intentionally schedule more downstream builds, closing the existing coverage gap.

Related issues

Fixes #365. Part of next-release quality checklist #366. Does not reopen deferred Harbor CI #350.

@Perry2004 please review shared-dependency coverage, scoped build behavior and the extracted selector contract.