CI paths: Release Precheck — stop running on every PR #851

Part of #834. Phase 3. Blocked on #850 (its anchor must be gated first, or this deadlocks the merge gate).

What

release-precheck.yml triggers on every PR with no paths:. It is the most expensive workflow in the repo (full build matrix, 4 jobs) and the long pole on the merge gate. It should run only for changes that can affect a shipped artifact.

Exact change

.github/workflows/release-precheck.yml — replace the on: block with:

on:
  pull_request:
    branches: [main]
    paths:
      - 'packages/**'
      - '!packages/*/changelog.d/**'
      - '!packages/*/migrations.d/**'
      - '!packages/*/e2e-attestations/**'
      - 'internals/checks/**'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - 'putitoutthere.toml'
      - '.github/workflows/release-precheck.yml'

Keep branches: [main]. Do not touch the jobs.

Ordering matters — GitHub evaluates paths: in order, last match wins, so the three ! exclusions must sit immediately after packages/** and before the unrelated positives.

Why these paths

Expected checks on this PR

Files touched: .github/workflows/release-precheck.yml only.

MUST run

• Release Precheck (self-path)
• Conventions (all 8 lanes) — still unconditional until phase 4

MUST NOT run

• Python Test, TS Test, Rust Test, Plugins Test, Python Lint, Python Typecheck, TS Lint, TS Typecheck
• Release Config Check and Changelog Check if their slices already merged; otherwise they still run

Anchor behaviour to verify: the Release Precheck reported protection from #850 does apply here (its if names this workflow file) and is satisfied, because the workflow runs. Confirm in the Merge Protections summary.

Acceptance

• CI paths: Mergify — gate each anchor behind the files it covers #850 merged to main first
• The PR's check list matches the groups above exactly
• Mergify Merge Protections green, with the Release Precheck reported entry showing as applied-and-satisfied
• Merge, close this issue

Notes

• The if in .mergify.yml is deliberately narrower than this paths: (it enumerates dirsql|src|napi subtrees positively rather than mirroring the exclusions). That direction is safe by design — see CI paths: Mergify — gate each anchor behind the files it covers #850's safety rule. Do not "tighten" this paths: to match the anchor; the anchor is the one that is allowed to lag.
• No changelog fragment, no e2e attestation.