CI paths: Changelog Check — stop running on every PR #853

Part of #834. Phase 3. Blocked on #850.

What

changelog-check.yml triggers on every PR with no paths:. A changelog fragment is only required for a non-test packages/<pkg>/ change, so that plus the fragment dirs themselves is the trigger surface. Spec rows 3–8 and 14.

Exact change

.github/workflows/changelog-check.yml — replace the on: block with:

on:
  pull_request:
    branches: [main]
    paths:
      - 'packages/**'
      - '!packages/*/e2e-attestations/**'
      - 'internals/checks/**'
      - '.github/workflows/changelog-check.yml'

Keep branches: [main]. Do not touch the check: job — its id is anchored as the bare check-success = check in .mergify.yml.

Why these paths

No Cargo.toml / Cargo.lock entry. Spec row 11 deliberately excludes Changelog Check from the root Cargo files: they sit outside packages/**, so no fragment is required and the gate would only pass vacuously.

Expected checks on this PR

Files touched: .github/workflows/changelog-check.yml only.

MUST run

• Changelog Check (self-path)
• Conventions (all 8 lanes) — still unconditional until phase 4

MUST NOT run

• Python Test, TS Test, Rust Test, Plugins Test, Python Lint, Python Typecheck, TS Lint, TS Typecheck
• Release Precheck and Release Config Check if their slices already merged

Acceptance

• CI paths: Mergify — gate each anchor behind the files it covers #850 merged to main first
• The PR's check list matches the groups above exactly
• Mergify Merge Protections green, with Changelog Check reported applied-and-satisfied
• Merge, close this issue

Notes

• The if in .mergify.yml is deliberately narrower than this paths: — safe direction, see CI paths: Mergify — gate each anchor behind the files it covers #850.
• No changelog fragment for this PR itself (no packages/** change), no e2e attestation.