ci: skip device lanes for root-level docs-only changes (#1781 A9)

[thymikee]

Summary

#1781 item A9-1: the pull_request paths-ignore blocks in ios.yml, android.yml, linux.yml, macos.yml, ci.yml, and size.yml already excluded docs/**, website/**, and README.md, but not the root-level docs files CONTEXT.md, AGENTS.md, SECURITY.md, CHANGELOG.md, CONTRIBUTING.md, LICENSE. Verified against history: PR #1568 (SECURITY.md only), #1697 (CONTEXT.md + docs/adr only), and #1722 (AGENTS.md + docs/) each still triggered a full 9-15 min macOS iOS run for a prose-only change.

This adds those six files to the paths-ignore block in all six workflows, identically.

Files added, per workflow

Same six lines added to ios.yml, android.yml, linux.yml, macos.yml, ci.yml, and size.yml (kept identical across all of them, as the existing list already was):

- 'AGENTS.md'
- 'CHANGELOG.md'
- 'CONTEXT.md'
- 'CONTRIBUTING.md'
- 'LICENSE'
- 'SECURITY.md'

Why each is safe (what I grepped)

• grep -rln "CONTEXT.md|AGENTS.md|SECURITY.md|CHANGELOG.md|CONTRIBUTING.md|LICENSE" across scripts/, src/, test/, and .github/actions/ finds only prose comments pointing humans at a CONTEXT.md/AGENTS.md section (e.g. scripts/layering/check.ts:2, scripts/wire-compat/run.ts:12, src/mcp/tool-ref-pins.ts:159) — never an fs.readFileSync/readFile of the file itself. No workflow step, script, or test parses any of these six files.
• scripts/check-affected/model.ts's isDocs() already classifies all six as pure docs (.md glob + the literal 'LICENSE'), and docsOwnership() only special-cases website/docs/docs/commands.md (unrelated). So these files already select zero checks in the affected-selector model — they only ever produced docsOnlyPaths entries, never a SelectionReason.
• Because they select zero checks, scripts/gate/model.ts's categories() (which iterates plan.reasons per tracked file) never records a category for any of these six files, so the gate-manifest's path-coverage assertion has nothing that requires these paths to stay reachable in any lane, including ci.yml.
• size.yml's bundle-size job (scripts/size-report.mjs) measures pnpm build's dist output and startup timing only — no reference to any of the six files. (npm does pack LICENSE/README.md into the publishable tarball, but that's ci.yml's packaged-cli-node-22-12 job / scripts/check-package.ts, which is driven by dist contents and package.json, not by doc prose — already evidenced by README.md being ignored here since before this change.)

Scope disclosure

• mutation-affected.yml uses a paths: allowlist, not paths-ignore — structurally unaffected, not touched.
• test-app-build-cache.yml has no path filter at all — not touched.
• pr-preview.yml uses a paths: allowlist scoped to website/** — a root-level docs file was never in its trigger set, so there's no paths-ignore list to touch. Not touched.
• deploy.yml triggers on push to main with no path filter at all — deliberately not scoped, so nothing to touch. Not touched.
• ci.yml was included: nothing in its jobs (static-checks, layering-guard, typecheck, coverage, fallow, etc.) reads any of the six files at runtime, and the gate-manifest model confirms no check category depends on them.

Test plan

• pnpm check:gate-manifest — green (48 checks wired across 33 lanes, 1 declared unprovable)
• pnpm check:gate-manifest:test — green (28/28)
• actionlint on all six changed workflow files — no output (clean)
• gh pr list --search "paths-ignore" --state open before starting — no conflicting open PR

CI note

CodeQL Analyze (java-kotlin) / Analyze (javascript-typescript) are red from GitHub's 2026-08-17 503 outage during result upload; default-setup scans can't be rerun via API; they will clear on the next push or a UI re-trigger. Nothing in this PR is analyzable by them (YAML only).

[github-actions]

Size Report

Metric	Base	Current	Diff
JS raw	2.26 MB	2.26 MB	0 B
JS gzip	744.4 kB	744.4 kB	0 B
npm tarball	863.7 kB	863.7 kB	0 B
npm unpacked	3.01 MB	3.01 MB	0 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	18.7 ms	20.9 ms	+2.2 ms
CLI --help	43.4 ms	50.4 ms	+7.0 ms

Top changed chunks: no changes in the largest emitted chunks.

[thymikee]

Request changes: the docs-only classifier is honest at this head, but the newly relied-on workflow policy lacks a regression pin. Add a focused test asserting every authorized root document—including LICENSE—appears in all six relevant paths-ignore lists, and show it red on the parent then green here. Generic Markdown coverage, actionlint, and gate-manifest cannot detect one omitted/removed root-doc entry. Project checks are otherwise green; iOS Smoke is pending and CodeQL reporting failures are GitHub HTTP 503 infrastructure.

[thymikee]

Added test/ci/root-docs-paths-ignore.test.ts (unit-core): asserts all six root docs are in all six workflows' paths-ignore; red on main (36/36 fail), green here; commit 994dab9.

[thymikee]

Re-reviewed exact head 994dab9. Clean readiness verdict: the new regression reads all six real workflow files, uses the gate matcher, and would fail if any root-doc paths-ignore policy entry were removed, closing the prior coverage gap. Exact-head CI is fully green and the branch is mergeable. Ready for human review.