[andrescera]

What

Every gate in this workflow now hangs off a changes job and a job-level if:, and one
always-run summary job reports for the whole workflow.

• changes runs dorny/paths-filter@v4 on pull requests only. On a push the step is
  skipped and the output falls back to true, so the canonical branch keeps full coverage.
• The code filter is an exclusion list — "every changed file is NOT documentation" —
  so its step carries predicate-quantifier: 'every'. The quantifier is a property of the
  step, not of a filter, which is why a positive OR list (where one exists) lives in its
  own step under the default some.
• The summary job runs if: always(), depends on every gated job, and is red whenever a
  dependency reports failure or cancelled. A skipped dependency passes — that is the
  whole point.

push: triggers are unchanged.

Why

A documentation-only pull request paid for the entire gate and proved nothing.

The obvious fix — a trigger-level paths:/paths-ignore: — is the wrong one: a workflow
that never starts reports no check at all, and branch protection then waits forever on a
report that will never arrive. Gating at the job level keeps the workflow running and lets
the summary job answer.

How to verify

1. Open a pull request that touches only *.md → only changes and the summary job run,
   and the summary is green.
2. Open a pull request that touches source → every job runs as before.
3. Break a test on a code branch → the summary job goes red.

Risks

• If the summary job is adopted as the required check, the individual job names stop
  reporting on a docs-only PR by design; branch protection must require the summary, not the
  individual jobs.
• A filter that is too broad silently skips a real gate. The exclusion list is deliberately
  narrow (**/*.md, docs/**, LICENSE*, PR/issue templates) and the summary job's
  needs: list is the structural check that nothing gated fell out of the report.