rootiest
4797af85f3
Adds scripts/** to the push path filter -- it was missing entirely, so that directory never triggered CI regardless of what changed there. pull_request no longer has a paths: filter (moved that check inside each job, in shell, since a label-only PR with no relevant diff still needs to trigger the workflow for the job-level label check to ever run). Added labeled/unlabeled to pull_request types for the same reason. Splits the old build-docs job into a docs job with two sections: doc tests/build (generate concat, verify-manual.py, compile man page) run whenever relevant on any event; publish (site build, Cloudflare deploy, commit-back) is step-gated to push/dispatch only, as before. The docs job now also runs on a PR when it's labeled Kind/Documentation or Area/Docs, or its diff touches docs/manual/**, docs/build-manual.py, docs/manualtools.py, docs/verify-manual.py, or docs/site/**. test gains the same shape: also runs on a PR labeled Kind/Testing, Area/Tests, Area/CI, or Area/Scripts, independent of what it touches. docs no longer needs: test. main's branch protection already requires test to pass before a PR merges, so by the time a push-to-main reaches this job, test has necessarily already passed; re-checking it here would be redundant. Leaves the same gap as block_admin_merge_override=false on that rule: a direct admin push bypasses it, an accepted trust boundary, not a new one.