ci: path-gate static ratchet scans in lint

.github/workflows/lint.yml

@@ -13,6 +13,28 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Detect Rust workspace and ratchet changes
+        id: paths
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            rust_workspace:
+              - 'rust/**'
+              - 'proto/sglang/runtime/v1/sglang.proto'
+              - '.github/workflows/lint.yml'
+            ratchet:
+              - 'python/sglang/**'
+              - 'scripts/lint/check_static_ratchets.py'
+              - 'scripts/lint/check_decode_bookkeeping_ownership.py'
+              - 'scripts/lint/check_global_config_read_ratchet.py'
+              - 'scripts/lint/check_legacy_global_ratchet.py'
+              - 'scripts/lint/check_module_state_ratchet.py'
+              - 'scripts/lint/check_parallel_adoption_ratchet.py'
+              - 'scripts/lint/check_server_args_mutation_ratchet.py'
+              - 'scripts/lint/test_check_*.py'
+              - '.pre-commit-config.yaml'
+              - '.github/workflows/lint.yml'
+
       # Fail-fast gate: docs_new/ was renamed to docs/ (#32123). git's rename
       # detection silently re-adds NEW files under docs_new/ on merge without a
       # conflict, which would resurrect the directory. We check the checked-out
@@ -47,13 +69,22 @@ jobs:
           workspaces: rust
           shared-key: "rust-workspace-lint"
 
+      # Ratchet gate: any output other than 'false' (including unclassified
+      # events) keeps check-static-ratchets — fail open like rust_workspace.
       - name: Run pre-commit checks
-        run: SKIP=no-commit-to-branch pre-commit run --all-files --show-diff-on-failure
+        run: |
+          skip="no-commit-to-branch"
+          if [ "${{ steps.paths.outputs.ratchet }}" = "false" ]; then
+            skip="$skip,check-static-ratchets"
+          fi
+          echo "ratchet changes: ${{ steps.paths.outputs.ratchet }}; SKIP=$skip"
+          SKIP="$skip" pre-commit run --all-files --show-diff-on-failure
 
       # Not in the rust-ext build job: its cache key covers the built .so files,
       # and a test script is not a build input. Tests take ~1s; the timeout is
       # for a cold cache, which codegens the dependency graph first.
       - name: Run rust/ workspace tests
+        if: steps.paths.outputs.rust_workspace == 'true'
         run: cd rust && timeout 900 cargo test --workspace
 
       - name: Run lychee docs checks (offline references)