fix(ci): fail the aggregate when change detection fails, rerun on PR edits, report the real deploy outcome

[drawmeanelephant]

Pull Request

Agent Completion Report

• Status: complete
• Branch and Worktree:
  • Branch: t3code/review-cicd-claims-optimization
  • Worktree: t3code-9151eea8 (linked worktree of the Boris repository)
• Commit and PR:
  • Commit: cc096f9f
  • Target PR / Branch: this PR, targeting main (the integration line declared in docs/STATUS.md)
• Linked Issues (auto-close convention):
  • None referenced. This change fixes three confirmed CI/CD workflow defects found during a review-only audit; it does not close or reference an open issue, and the lint self-test covers the no-reference path.
• Changed Files:
  • .github/workflows/ci.yml
  • .github/workflows/github-pages.yml
  • docs/changelog.d/999-ci-aggregate-changes-and-pages-summary.md
• Preserved Unrelated Files:
  • Affirmed: no other files touched; sibling worktrees (t3code/*, the revert/997-contract-claims-gate checkout) and their branches are intact and unmodified.
• Implementation Summary:
  • Required ci aggregate: the changes (dorny/paths-filter) job is now listed in needs and its result must be success. Previously a failed change-detection job skipped the conditional lanes (standalone_tools_test, testdata_generator_test, job-runner-image), and the aggregate's explicit success || skipped acceptance read those skips as green — a broken filter could hide affected tool lanes from a required check.
  • PR edited event added to the pull_request trigger so editing a PR body reruns the workflow and the pr-issue-close lint revalidates the current body (previously, editing a body to fix or break closing-keyword declarations left the lint result stale). Known trade-off, accepted for this slice: the edited event reruns the full workflow rather than only the lint lane.
  • Optional GitHub Pages post-deploy audit summary: the always()-guarded summary step now prints steps.deployment.outcome instead of an unconditional "succeeded (deploy-pages completed)" line, so a failed deploy-pages step can no longer produce a success claim in the run summary.
  • Changelog fragment 999-ci-aggregate-changes-and-pages-summary.md added per docs/changelog.d/README.md.
• Known Gaps:
  • Two review findings were deliberately left out of this slice, pending measured decisions: (1) the optional audit's worst-case request budget (256 requests × 10 s timeouts) can exceed the 15-minute deploy-job window before incomplete evidence is written; (2) docs/github-pages.md lists stale Pages action majors and scopes the "no post-deploy HTTP claim" sentence too broadly. Neither is a green/red CI behavior change.
  • The behavior changes are verified statically (actionlint) plus by inspection of the GitHub Actions expression semantics; a live run of the aggregate now in progress on this PR exercises the normal path.
  • Local npm --prefix editor/ui run check could not run (no node_modules in the worktree); the editor lane is untouched by this change.
• Exact Commands Run:
  1. git status --short && git branch --show-current
  2. git fetch origin && git rev-list --left-right --count HEAD...origin/main
  3. zig build test
  4. ./scripts/release-gate.sh
  5. zig fmt --check build.zig build.zig.zon src tools test fixtures
  6. ./scripts/check-pr-issue-close.sh --selftest
  7. actionlint .github/workflows/ci.yml .github/workflows/github-pages.yml .github/workflows/greptile-trex.yml
  8. find docs/changelog.d -maxdepth 1 -type f -name '[0-9]*-*.md' -print | LC_ALL=C sort
  9. git diff --check
• Exact Gate Results:
  • zig build test: pass (on base c0305215 before the workflow-only edits)
  • ./scripts/release-gate.sh: pass ("RELEASE GATE PASSED", includes zig build, zig build test, dual-RAG determinism, IR goldens, fixture diagnostics, cleanliness checks)
  • zig fmt --check …: pass
  • ./scripts/check-pr-issue-close.sh --selftest: pass (61 cases)
  • actionlint …: pass (all three workflows)
  • find docs/changelog.d … | LC_ALL=C sort: fragment sorts in numeric order (995, 998, 999)
  • git diff --check: pass (no whitespace errors)
• Determinism Result:
  • N/A — workflow metadata and documentation changes only; no compiler output is affected.
• Generated Artifacts:
  • None untracked in the commit (.release-gate/ scratch from the release gate lives in the ignored tree).
• Blockers:
  • Blockers: None.
  • Next Card: measure the optional audit's request budget against the deploy-job window and size explicit bounds (or a dedicated audit job) so a slow site still retains incomplete evidence; refresh docs/github-pages.md action-version list in the same or follow-up slice.