docs(quick-260613-fp9): document ci.yml heavy-job paths-filter fix

dorny/paths-filter combines patterns with Array.some, and picomatch compiles
'!.gitea/**' as 'any path not under .gitea'. The '- !.gitea/**' line (from
quick task 260613-dmw) therefore matched every non-.gitea file — including
.planning/** and *.md — so code=true for doc-only PRs and the heavy api/harness
jobs ran anyway. It also never excluded .gitea (the **/*.yml glob already
matched workflow files), regressing the Phase 15 doc-only skip.

Switch to predicate-quantifier 'every' with negation-only globs: a file counts
as code only if it is outside .gitea/, outside .planning/, and not Markdown.
Verified with picomatch against representative file sets.

.gitea/workflows/ci.yml

@@ -16,20 +16,22 @@ jobs:
       - uses: dorny/paths-filter@v4
         id: filter
         with:
+          # 'every' + negation-only globs. dorny combines a filter's patterns with
+          # Array.some by default, and picomatch compiles '!.gitea/**' as "matches any
+          # path NOT under .gitea" — so under 'some' that single line matched EVERY
+          # non-.gitea file (incl. .planning/** and *.md), flipping code=true for
+          # doc-only PRs and silently running the heavy api/harness jobs (regression
+          # introduced by quick task 260613-dmw; the old positive allowlist also never
+          # actually excluded .gitea because '**/*.yml' already matched workflow files).
+          # With predicate-quantifier 'every' a changed file counts as "code" ONLY if it
+          # matches ALL patterns — i.e. it is outside .gitea/, outside .planning/, and is
+          # not Markdown. Verified against representative file sets in quick task 260613-fp9.
+          predicate-quantifier: 'every'
           filters: |
             code:
-              - '**/*.ts'
-              - '**/*.tsx'
-              - '**/*.js'
-              - '**/*.json'
-              - '**/*.yaml'
-              - '**/*.yml'
-              - 'apps/**'
-              - 'packages/**'
-              - 'pnpm-lock.yaml'
-              - 'Dockerfile'
-              - 'docker-compose*.yml'
               - '!.gitea/**'
+              - '!.planning/**'
+              - '!**/*.md'
 
   fast-checks:
     runs-on: ubuntu-latest

.planning/quick/260613-fp9-gitea-and-planning-pushes-should-not-tri/260613-fp9-SUMMARY.md

@@ -54,8 +54,40 @@ phase-10 agent has the main working tree checked out on
 `gsd/phase-10-admin-role-settings`. No subagents spawned — trivial single-file
 config edit done inline.
 
+## Follow-up fix — ci.yml heavy-job paths-filter (added after PR opened)
+
+Opening PR #16 surfaced a second, related bug: the `api` + `harness` jobs ran on
+this `.gitea`/`.planning`-only PR. Root cause in `.gitea/workflows/ci.yml`'s
+`changes` job:
+
+- dorny/paths-filter combines a filter's patterns with `Array.some`, and
+  picomatch compiles `!.gitea/**` as "matches any path **not** under `.gitea`".
+- So the `- '!.gitea/**'` line (added by quick task 260613-dmw) matched every
+  non-`.gitea` file — including `.planning/**` and `*.md` — making `code=true`
+  for doc-only PRs and silently running the heavy jobs. It also never excluded
+  `.gitea` (the `**/*.yml` glob already matched workflow files), so dmw's stated
+  goal was never achieved and it regressed the Phase 15 doc-only skip.
+
+Fix: switched the filter to `predicate-quantifier: 'every'` with negation-only
+globs so a file counts as `code` ONLY if it is outside `.gitea/`, outside
+`.planning/`, and not Markdown:
+
+```yaml
+predicate-quantifier: 'every'
+filters: |
+  code:
+    - '!.gitea/**'
+    - '!.planning/**'
+    - '!**/*.md'
+```
+
+Verified locally with picomatch against representative file sets: `.gitea`-only,
+`.planning`-only, `*.md`-only, and this PR's mix all → `code=false` (heavy jobs
+skip); real code (`.ts`), `pnpm-lock.yaml`, `package.json`, and code+docs mixes
+all → `code=true` (heavy jobs run).
+
 ## Follow-up
 
-`publish.yml` lives under `.gitea/**`, so merging this change will itself be a
-`.gitea`-only push and will (correctly) not publish. Open a PR to `main`
+`publish.yml` and `ci.yml` both live under `.gitea/**`, so merging this PR is a
+`.gitea`-only push and will (correctly) not publish. PR #16 opened against `main`
 (protected; code changes require PR).