feat(15-02): add changes job and gate api/harness on code output

- insert changes job (dorny/paths-filter@v4) before fast-checks
- changes job: permissions pull-requests:read, outputs code, no checkout
- code filter lists positive patterns: **/*.ts, apps/**, pnpm-lock.yaml, Dockerfile, etc.
- api job: needs [changes] + if combined with needs.changes.outputs.code == 'true'
- harness job: same needs/if pattern as api
- services, env, and step bodies unchanged in both heavy jobs

.gitea/workflows/ci.yml

@@ -5,6 +5,31 @@ on:
     branches: [main]
 
 jobs:
+  changes:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    permissions:
+      pull-requests: read
+    outputs:
+      code: ${{ steps.filter.outputs.code }}
+    steps:
+      - uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          filters: |
+            code:
+              - '**/*.ts'
+              - '**/*.tsx'
+              - '**/*.js'
+              - '**/*.json'
+              - '**/*.yaml'
+              - '**/*.yml'
+              - 'apps/**'
+              - 'packages/**'
+              - 'pnpm-lock.yaml'
+              - 'Dockerfile'
+              - 'docker-compose*.yml'
+
   fast-checks:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
@@ -42,8 +67,9 @@ jobs:
 
   api:
     runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
+    needs: [changes]
-    # Runs in PARALLEL with fast-checks (D-03) — no needs: dependency.
+    if: github.event_name == 'pull_request' && needs.changes.outputs.code == 'true'
+    # Runs in PARALLEL with fast-checks (D-03) — skipped for doc-only PRs.
     services:
       mariadb:
         image: mariadb:11
@@ -128,8 +154,9 @@ jobs:
 
   harness:
     runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
+    needs: [changes]
-    # Runs in PARALLEL with fast-checks + api (D-03) — no needs: dependency.
+    if: github.event_name == 'pull_request' && needs.changes.outputs.code == 'true'
+    # Runs in PARALLEL with fast-checks (D-03) — skipped for doc-only PRs.
     services:
       mariadb:
         image: mariadb:11