ci: docs-only PRs can never merge — required build checks are path-ignored on docs changes

[Danathar]

What happens

No documentation-only PR has been able to merge since 2026-09-12. Examples, all green on validate, with two approvals or one approval waiting on a second:

• docs(skills): maintainer-driven tool actions and duplicate-cluster resolution #970 (approved by hanthor + me; auto-merge enabled since 09-12) — mergeStateStatus: BLOCKED
• docs(contributing): add reviewer-ladder.md — concrete proposal for the reviewer-scaling rung #1080 (approved by castrojo)
• docs: fix grammatical and readability problems README.md #1017 (approved by hanthor)
• docs: record that system_files/nvidia/ is unconsumed and has no CDI preset — docs/skills/nvidia/{SKILL.md,references/architecture.md}, system_files/nvidia/README.md #1125 (approved by me)

Cause

The main — merge queue ruleset was updated on 2026-09-12 at 17:46 EDT to require these status checks:

• validate
• Build and push image (x86_64)
• Build and push image (aarch64)

but .github/workflows/build.yml has

on:
  pull_request:
    paths-ignore:
      - '*.md'
      - 'LICENSE'
      - '.gitignore'
      - 'docs/**'
      - 'AGENTS.md'

so on a docs-only PR the two build checks never report at all. GitHub treats a required check that never reports as unsatisfied, and a PR that can't satisfy branch protection can't enter the merge queue either — it stays BLOCKED forever. bypass_actors on the ruleset is empty, so admins can't push it through either.

#1000 (README-only) merged at 21:46 UTC on 09-12 — the same minute the ruleset changed — and is the last docs-only PR to land.

Fix options

1. Keep the required checks, always report them. Drop paths-ignore from build.yml's pull_request trigger and gate the expensive work with a first job that computes whether image inputs changed (dorny/paths-filter or a git diff --name-only step); when nothing relevant changed, the build jobs still run but exit early with success. The check names then exist on every PR. This is the pattern that keeps the ruleset honest.
2. Only require validate. Simpler, but then a PR that breaks the image can merge on a green validate, which is presumably why the checks were added.

(1) is the one I'd pick. Until one of them lands, every docs-only PR in the queue is stuck regardless of approvals.

[Danathar]

projectbluefin/actions#536 fixes the same class of problem there and is the pattern to copy here: run the workflow on every pull request (no paths/paths-ignore on the trigger), skip the expensive steps with a step-level if: when no image inputs changed, and add a merge_group: trigger so the queue can see the required checks. Its docs/skills/testing.md section "Required checks must be reachable" explains the deadlock plainly.