Gate LINE_THRESHOLD on production-code churn only (#67722)

`SelectiveChecks._is_large_enough_pr`'s line-count check previously
summed every changed line (minus a small set of lock/newsfragment
exclusions), so a 1000-line docs or test-only PR was treated as the
same risk shape as a 1000-line scheduler change and would force the
full CI matrix. The file-count check stays unchanged; only the line
count is narrowed.

Compose the existing `PYTHON_PRODUCTION_FILES`,
`JAVASCRIPT_PRODUCTION_FILES`, and `HELM_FILES` groups for the
production-code filter rather than rolling a parallel pattern set,
and tighten the first two to actually match production-only paths:

- `PYTHON_PRODUCTION_FILES` now excludes test paths (the old
  `^providers/.*\.py` matched provider tests too), adds `task-sdk/src/`,
  `airflow-ctl/src/`, `shared/*/src/`, and excludes `openapi-gen/`,
  `i18n/locales/`, generated datamodels within those trees.
- `JAVASCRIPT_PRODUCTION_FILES` excludes `openapi-gen/` and translation
  bundles for the same reason.

`run_python_scans` / `run_javascript_scans` (the other consumers of
`*_PRODUCTION_FILES`) also become more accurate as a side-effect — SAST
and SCA targets are now production code, not tests.

Five test cases added to cover test-only, docs-only, generated-only,
and mixed (above and below threshold) PRs; the existing three cases
still hold.