ci(docs): run frontmatter gate on every push/PR (drop paths filter)

[temalo]

What

Removes the paths: filter from the Validate docs (frontmatter) workflow so it runs on every PR and every push to main, unconditionally.

Why — corrected root cause

My earlier diagnosis (relayed to Ted + Ben) said the gate "only runs when the validator file itself changes." That was wrong — the workflow already listed **/*.md under both pull_request and push. The real, evidence-backed finding:

• dd4ce68 (the em-dash sweep) was a direct push to main touching 358 .md files on 2026-06-22.
• The validate.yml gate already existed at that point (added 2026-06-17, PR ci(hermes): frontmatter validation gate — block broken YAML before deploy #39) and its paths filter matched.
• Yet the run history shows zero Validate docs runs for that push — the gate's first-ever push-to-main runs are both today (6/26). So a path-filtered push trigger silently failed to fire on the exact bulk direct-push it was meant to catch.

Rather than keep debugging why the path filter didn't evaluate on that push (GitHub's path-filter behavior on bulk/direct pushes is the suspect), the robust fix is to stop gating a ~12-second check behind a path glob at all. The marketplace/SEO sweeps push straight to main in bulk; the check is cheap and the blast radius of skipping it is "every docs PR blocked." Run it on everything.

Change

 on:
-  pull_request:
-    paths:
-      - '**/*.md'
-      - 'scripts/validate_frontmatter.py'
-      - '.github/workflows/validate.yml'
-  push:
-    branches: [main]
-    paths:
-      - '**/*.md'
-      - 'scripts/validate_frontmatter.py'
-      - '.github/workflows/validate.yml'
+  pull_request:
+  push:
+    branches: [main]
   workflow_dispatch:

Verify

• Workflow YAML parses; triggers = pull_request (all), push→main (all), workflow_dispatch. No paths filter on either.
• This PR itself touches NO .md file — under the OLD filter the gate would NOT have run on it; under the new config it runs. That's the regression test: if Validate docs shows green on this PR, the fix works (the old config would have skipped it).