[PR-C/Phase 5] Add root-config paths to per-workspace workflow triggers #162

Problem

Per-workspace CI workflows filter by workspace-specific paths. A commit that only touches pnpm-workspace.yaml or root .github/ config files won't trigger cli-ci.yml, desktop-ci.yml, or droplet-ci.yml.

PR #155's final commit fe378d9a changed only .codecov.yml — no per-workspace path filter matched, so all Rust workspace CI was skipped. Three new Rust test files (cli/tests/{config,manifest,upload}_test.rs) + Cargo.lock changes had zero CI coverage.

Current path filters:

Fix

Add root config paths to cli-ci.yml, desktop-ci.yml, droplet-ci.yml (parallelizable edits).

5b. cli-ci.yml

# Before
paths:
  - "cli/**"
  - ".github/workflows/cli-ci.yml"

# After
paths:
  - "cli/**"
  - ".github/workflows/cli-ci.yml"
  - "pnpm-workspace.yaml"
  - "package.json"
  - "pnpm-lock.yaml"

5c. desktop-ci.yml — same pattern

5d. droplet-ci.yml — same pattern

Verification Gate

# Create a branch that only modifies pnpm-workspace.yaml
git checkout -b remediation/test-root-config
# Touch pnpm-workspace.yaml (no actual content change, just touch)
touch pnpm-workspace.yaml
git commit -am "test: root-config trigger"
git push origin remediation/test-root-config
gh pr create --base develop --head remediation/test-root-config \
  --title "test: root-config triggers per-workspace CI" --draft

# Expected: all three per-workspace CIs fire
sleep 60
gh run list --workflow "CLI CI" --branch remediation/test-root-config
gh run list --workflow "Desktop CI" --branch remediation/test-root-config
gh run list --workflow "Droplet CI" --branch remediation/test-root-config
# All should show at least 1 run

Risk

LOW. Adds CI runs but correctly so. CI minutes cost increase is small.

Rollback

Revert the path additions.

Effort

~30 min (3 files, all same mechanical change — parallelizable)

Provenance

Adversarial 4-member hyperplan, 3 rounds. Phase 5 of umbrella.