E2E: classify non-deploying PRs before waiting for a Vercel preview #2411

Problem

The required E2E workflow assumes every pull request receives an exact-SHA Vercel preview. That is false for PRs which change no Vercel deployment input: Vercel can skip an unaffected project, leaving the workflow to poll for a deployment that will never exist.

PR #2408 reproduces the defect. Its exact-head E2E run 38268163270 / job 114875533086 polled GitHub deployments 12 times at ten-second intervals, then failed with No Vercel preview deployment became available before any E2E test executed. The PR changes only CI/security artifacts, scripts, and tests—not apps/ or the root npm/turbo/Vercel build inputs. A fresh search found no open issue or PR for this failure mode.

This is a false-red gate, not an E2E test failure. A manually created exact-SHA Preview also does not repair the automation because it does not create the GitHub deployment record the workflow queries.

Proposed solution

• Define EventRelay's Vercel deployment inputs in one reviewed manifest.
• On pull requests, fetch every changed file through the GitHub API and classify both the current and previous path so renames cannot hide deployment impact.
• For deployment-impacting PRs, preserve the exact-preview lookup and fail closed if the preview is unavailable.
• For non-deploying PRs, keep the required E2E job present and successful, but report the live suite as not applicable instead of claiming a test pass or probing production.
• Continue running the full live suite on every push to main.

Acceptance criteria

• The E2E Pipeline Tests job still runs on every PR, regardless of base branch.
• Changes under apps/ and changes to root npm/turbo/Vercel build inputs require the PR's exact preview and live E2E run.
• CI, documentation, security tooling, and ordinary unit-test-only changes do not wait for a preview Vercel does not build.
• Renames check both filename and previous_filename.
• A non-deploying verdict is reported as not applicable, not ALL TESTS PASSED.
• Pushes to main still execute the full live suite.
• Regression tests pin the trigger, classifier, execution-step conditions, and positive/negative path cases.

Local evidence

• Focused workflow-gate suite: 35 passed.
• git diff --check: passed.
• Measured classifier result for PR feat(security): validate offline MCP catalog approval pins #2408's six changed paths: needs_preview=false.
• Measured controls: apps/web/src/app/page.tsx and package-lock.json both produce needs_preview=true.