Make Windows smoke gate required-check-safe via sentinel job

Summary

• A paths-filtered workflow can't be a required status check: it never reports on PRs that don't touch the filtered paths, so those PRs get stuck "Expected — waiting for status" and can't merge. (Surfaced when wiring the gate from #407 into branch protection.)
• Restructure tentacle-windows-smoke-e2e.yml into a 3-job sentinel pattern so the gate can be required without freezing unrelated PRs:
  • detect (ubuntu, ~20s) — did the PR change Tentacle-relevant paths?
  • tests (windows-latest) — the 54 lifecycle tests, run only when relevant → 0 Windows minutes on frontend/server/docs PRs.
  • gate (ubuntu, if: always()) — carries the required check "Windows Lifecycle Smoke (PR gate)"; green when tests passed or weren't needed, red when they failed.
• Keeps the cost optimization of the path scope while making the check safe to require. Required-check context name unchanged. Strictly a CI-workflow change.

Test plan

• YAML validates; 3 jobs; gate carries the required-check name; pull-requests: read granted for the detect step
• This PR touches the workflow (a relevant path) → detect = relevant → tests runs 54/54 → gate green
• After merge: re-add "Windows Lifecycle Smoke (PR gate)" as a required status check (now safe — the gate always reports)