ci: speed up PR link checks by scanning modified Markdown only

[mogul]

Summary

The Link Check job currently scans every Markdown file on pull requests and took about 3m41s-3m52s on #391, while the next slowest check was about 44-47s.

Proposed change

Configure the pinned tcort/github-action-markdown-link-check step to check only modified Markdown files on pull requests, while preserving full-repository link checks on pushes to main.

Suggested workflow inputs:

check-modified-files-only: ${{ github.event_name == 'pull_request' && 'yes' || 'no' }}
base-branch: "main"

Why

Pull requests usually touch a small number of Markdown files, so rechecking the entire repository on every PR spends most of the runtime on unrelated existing links. A full scan on main still catches repository-wide link rot after merge.

Blocker

This was identified while fixing the Link Check failure in #391. The available token in that session could not push changes to .github/workflows/ci.yml because it lacks the GitHub workflow scope:

refusing to allow a Personal Access Token to create or update workflow `.github/workflows/ci.yml` without `workflow` scope

Acceptance criteria

• Pull request Link Check scans only changed Markdown files.
• Pushes to main still run a full repository Link Check.
• Link Check runtime on typical PRs drops materially below the current ~3m40s baseline.
• Workflow change is reviewed by a maintainer with permission to update GitHub Actions workflows.

AI-assisted issue filing by OpenCode Agent.

[wz-gsa]

Grooming note (2026-08-27): the exact CI change this asks for (check-modified-files-only/base-branch in .github/workflows/ci.yml, plus a federal-link ignore-pattern) is already present as an unrelated third commit on open PR #391 ("feat(paseo): register child repos in parent mounts"). Flagging so reviewers of #391 know it also changes CI-wide link-check behavior repo-wide, not just paseo — and so this issue closes automatically once #391 merges rather than being duplicated.