ci: MariaDB hub tests out of the PR gate, as an hourly run on main; PostgreSQL and SQLite stay per PR

tsk-p7dfb6e9p5wz in progress Maity OPS Team (maity-ops-team)

Oliver left it to A (chat 2026-10-31): the hub database jobs hold up every merge (60–90 min per run, and main runs one at a time). Decision:

PR CI and ci-ok: hub-sqlite and hub-postgresql (prod runs PostgreSQL) stay required on hub changes; hub-mariadb leaves the PR gate and ci-ok.
New scheduled workflow on main: hub-mariadb at most once an hour, only when main has hub changes since the last green MariaDB run (skip otherwise). A red run posts a notice to oz-agent-a and ops (or a ticker item) naming the commit range, so the culprit is found within the hour.
Before a release tag / a deploy SHA: MariaDB must be green on that SHA (manual dispatch with a SHA input, so A can run it for a deploy candidate).
Also: use the fourth CI server Oliver is setting up with you for the hub DB jobs if that is how runners are labelled.

Document in the CI KTW (why MariaDB is not per PR, what keeps it from rotting), update the contributor docs that mention the required checks. Coordinate the switch so that no open PR's ci-ok breaks.