docs(quick-260613-fp9): document ci.yml heavy-job paths-filter fix

.planning/quick/260613-fp9-gitea-and-planning-pushes-should-not-tri/260613-fp9-SUMMARY.md

@@ -54,8 +54,40 @@ phase-10 agent has the main working tree checked out on
 `gsd/phase-10-admin-role-settings`. No subagents spawned — trivial single-file
 config edit done inline.
 
+## Follow-up fix — ci.yml heavy-job paths-filter (added after PR opened)
+
+Opening PR #16 surfaced a second, related bug: the `api` + `harness` jobs ran on
+this `.gitea`/`.planning`-only PR. Root cause in `.gitea/workflows/ci.yml`'s
+`changes` job:
+
+- dorny/paths-filter combines a filter's patterns with `Array.some`, and
+  picomatch compiles `!.gitea/**` as "matches any path **not** under `.gitea`".
+- So the `- '!.gitea/**'` line (added by quick task 260613-dmw) matched every
+  non-`.gitea` file — including `.planning/**` and `*.md` — making `code=true`
+  for doc-only PRs and silently running the heavy jobs. It also never excluded
+  `.gitea` (the `**/*.yml` glob already matched workflow files), so dmw's stated
+  goal was never achieved and it regressed the Phase 15 doc-only skip.
+
+Fix: switched the filter to `predicate-quantifier: 'every'` with negation-only
+globs so a file counts as `code` ONLY if it is outside `.gitea/`, outside
+`.planning/`, and not Markdown:
+
+```yaml
+predicate-quantifier: 'every'
+filters: |
+  code:
+    - '!.gitea/**'
+    - '!.planning/**'
+    - '!**/*.md'
+```
+
+Verified locally with picomatch against representative file sets: `.gitea`-only,
+`.planning`-only, `*.md`-only, and this PR's mix all → `code=false` (heavy jobs
+skip); real code (`.ts`), `pnpm-lock.yaml`, `package.json`, and code+docs mixes
+all → `code=true` (heavy jobs run).
+
 ## Follow-up
 
-`publish.yml` lives under `.gitea/**`, so merging this change will itself be a
+`publish.yml` and `ci.yml` both live under `.gitea/**`, so merging this PR is a
-`.gitea`-only push and will (correctly) not publish. Open a PR to `main`
+`.gitea`-only push and will (correctly) not publish. PR #16 opened against `main`
 (protected; code changes require PR).