ci: run only the suites a PR's paths can reach, and 4 xdist workers

[philmerrell]

Summary

The PR gate ran every suite on every pull request. A two-file docs PR paid the same 7–8 minutes as a backend change, and the backend pytest job alone was 7:02 while every other job finished in under 2 minutes. Two changes:

Fix 1 — run only the suites a PR's paths can reach. A changes job in ci.yml reads the PR's file list from the REST API (no third-party action, no fetch-depth games, renames fed under both names) and pipes it through scripts/ci/classify-changes.sh, which maps paths to the run_* inputs tests.yml already had:

Changed paths	Suites
docs/, docs-site/, tui/, root markdown, LICENSE	none
backend/	backend, load-test unit
backend/scripts/	+ infrastructure (jest asserts the backfill scripts exist)
frontend/	frontend, frontend under --coverage
infrastructure/, RELEASE_NOTES.md	infrastructure + a new contracts-only backend job (supply_chain + architecture, the tests that read the CDK tree, ~30 s)
.claude/	infrastructure (one jest test reads the release skill)
.github/, scripts/, anything unrecognised, empty list, workflow_dispatch	everything

Fail-open by construction: only the explicit first row runs nothing. Filtering is on the jobs, not the trigger's paths:, so a skipped suite reports as skipped rather than stranding a required check as "Expected" if develop ever gains one (it has none today, which is worth knowing on its own).

Fix 2 — -n logical. With psutil installed, -n auto counts physical cores; the 4-vCPU runner reports 2, so every run started 2 xdist workers (created: 2/2 workers in the logs). logical starts 4.

Guard

backend/tests/supply_chain/test_ci_path_filter.py pins the classifier's rules and fail-open cases, asserts every run_* input tests.yml offers is wired in ci.yml (a new suite cannot silently run nowhere on a PR), and asserts the backend step stays on -n logical.

Also

• The Testing doc page was a placeholder that still said pytest was not run in CI; it now describes the suites and this mapping.
• Follow-ups filed with the profile behind them: ci: shard the backend pytest job across runners with pytest-split #1390 (shard the backend job with pytest-split) and test: scope moto fixtures at module level (setup is 82% of backend suite time) #1391 (scope moto fixtures at module level — setup is 82% of measured suite time). Queued in docs/kaizen/review-queue.md.

Verification

• backend/tests/supply_chain + tests/architecture: 213 passed (32.9 s, which is the contracts job's expected runtime). Root tests/supply_chain: 48 passed.
• This PR touches .github/, so its own CI run should show the changes job classifying to everything; the first docs-only PR after merge is the real proof of the skip path.

🤖 Generated with Claude Code