fix(ci): stop the desktop paths-filter from matching every PR

[serina-mcfall]

Summary

ci.yml's desktop path filter mixed a positive glob with a standalone negation, which picomatch treats as an independent OR clause — the negation alone matched almost every file in the repo, so desktop=true for nearly any PR including docs-only ones. Removes the exclusion and adds a regression guard.

Related issue

Closes #181

Issue type

Bug

---

Agent provenance

Field	Value
Harness / provider	Claude Code
Model	claude-sonnet-5
Session reference	N/A - harness does not expose a session URL
Initiating human	@serina-mcfall

Objective

Fix .github/workflows/ci.yml's desktop path filter so docs-only PRs stop running (and failing) the full Desktop CI suite.

Impacted components

• .github/workflows/ci.yml
• scripts/test-ci-changed-paths-filter.sh

Approach and rejected alternatives

Considered setting predicate-quantifier: every on the desktop filter so desktop/** AND NOT desktop/src-tauri/** would be evaluated as a conjunction. Rejected: predicate-quantifier is set once for the whole dorny/paths-filter step, not per filter, so it would also change the semantics of rust, web, and mobile (requiring every changed file to match, not any), breaking multi-file PRs across those filters. Dropping the exclusion entirely is correct instead: every job condition that reads outputs.desktop already ORs in outputs.desktop-rust, which independently and correctly matches desktop/src-tauri/**, so no job-gating behavior changes for real Tauri work.

Verification

Command run:

cd /home/serina/Launchpad/buzz__worktrees/fix-desktop-paths-filter
./scripts/test-ci-changed-paths-filter.sh

Raw output:

changed-paths filter contract passed
exit: 0

Command run:

node -e "
const path = require.resolve('picomatch', {paths: ['/home/serina/Launchpad/buzz/node_modules/.pnpm/picomatch@4.0.4/node_modules/picomatch']});
const picomatch = require(path);
const buggy = picomatch(['scripts/check-file-sizes-core.mjs','scripts/check-file-sizes-core.test.mjs','desktop/**','!desktop/src-tauri/**','pnpm-lock.yaml'], { dot: true });
const fixed = picomatch(['scripts/check-file-sizes-core.mjs','scripts/check-file-sizes-core.test.mjs','desktop/**','pnpm-lock.yaml'], { dot: true });
const f = 'launchpad/plans/2026-08-12-issue-117-review-dimensions.md';
console.log('buggy filter matches', f, '=>', buggy(f));
console.log('fixed filter matches', f, '=>', fixed(f));
console.log('fixed filter matches desktop/src/App.tsx =>', fixed('desktop/src/App.tsx'));
"

Raw output:

buggy filter matches launchpad/plans/2026-08-12-issue-117-review-dimensions.md => true
fixed filter matches launchpad/plans/2026-08-12-issue-117-review-dimensions.md => false
fixed filter matches desktop/src/App.tsx => true

Command run:

python3 -c "import yaml; yaml.safe_load(open('.github/workflows/ci.yml')); print('YAML OK')"

Raw output:

YAML OK

Also confirmed scripts/test-ci-changed-paths-filter.sh fails with the expected ::error:: message when run against a reconstructed copy of the original (buggy) filter block, before it was fixed here.

• Tests or checks were run and the raw output is pasted above
• The diff is confined to the scope of the linked issue
• No secrets, keys, tokens or hostnames were added to tracked files

Not verified

Did not run the full Desktop Core / Desktop Smoke E2E / Desktop E2E Integration suites end-to-end locally (they need Postgres/Redis and take 10-20 minutes each); relying on this PR's own CI run for that, since it touches .github/workflows/ci.yml and will trip rust=true regardless of this fix. Also did not verify behavior against every other open PR retroactively — confirmed the mechanism directly against picomatch instead of re-running all 8 affected PRs' CI.

Security implications

None. This only changes which CI jobs run for a given diff; it does not change any runtime code, permissions, or secret handling. desktop/src-tauri/** changes still get full desktop-rust coverage via the independent desktop-rust filter output.

Escalations

This PR's own CI run surfaced a second, unrelated failure: the Security job (cargo deny check) fails on advisories due to yanked crates (spin 0.9.8 and 0.10.0, transitive via mesh-llm-host-runtime → iroh/n0-future/mdns-sd/flume). It's pre-existing on the launchpad branch, not caused by this diff — confirmed no other currently-open PR even triggers the Security job, because this is the only one that touches a rust-filtered path (.github/workflows/ci.yml is explicitly listed in the rust filter). Have not touched deny.toml or Cargo.lock to address it since that's a dependency-health decision outside this issue's scope - raising it rather than deciding it.