ci: PR tier on hosted runners, docs-only fast path, cancel only superseded PR runs

[luisleo526]

Title: ci: PR tier on hosted runners, docs-only fast path, cancel only superseded PR runs

Why. PR CI for same-repo PRs ran on the self-hosted pool, so the wall time was dominated by pool queueing, not by work. Measured on the last 100 completed PR runs: PR wall (code PRs, 30 heads) median 1.2 min, p90 19.1 min, max 75.8 min; the CI jobs themselves run 18-118 s (CI run 39246686140: job queue 113-1570 s). Rule #720: no pool VM in a PR.

What.

• Every pool-routed job (CI 6 definitions, Documentation 1, Native feed 3) runs on ubuntu-24.04 for every pull_request; push to main and workflow_dispatch keep today's runners.
• ci.yml: new PR-only changes job; a PR that touches only docs/**, mkdocs.yml, README.md, CONTRIBUTING.md or LICENSE skips Docker runtime, Database E2E, Release contract and Distribution. The Python matrix always runs (it holds the documentation link test). release/ready accepts exactly that outcome and writes no release evidence for it; push to main and every code PR (including the App's release PRs) still require all five jobs and produce the evidence.
• docs.yml: concurrency cancels only superseded PR runs (was cancel-in-progress: true for every ref).
• No job, check name or workflow name removed or renamed; no secret, token scope or permission added.
• Tests: pinned ready.needs updated; new tests/test_pr_tier_workflows.py pins the routing, cancellation, permissions, the docs-only classification and the release/ready gate, each with must-fail forms.

Before / after job list (no workflow has a schedule trigger)

workflow	job (check name)	runner on pull_request: before -> after	pull_request	push (main)	docs-only PR
CI	changes (new)	n/a -> ubuntu-24.04	runs	skipped	runs
CI	Python 3.11 / 3.12 / 3.13	pool -> ubuntu-24.04	runs	runs, pool (unchanged)	runs
CI	Docker runtime	pool -> ubuntu-24.04	runs	runs, pool (unchanged)	skipped
CI	Database E2E	pool -> ubuntu-24.04	runs	runs, pool (unchanged)	skipped
CI	Release contract	pool -> ubuntu-24.04	runs	runs, pool (unchanged)	skipped
CI	Distribution	pool -> ubuntu-24.04	runs	runs, pool (unchanged)	skipped
CI	release/ready	pool -> ubuntu-24.04	runs	runs, pool (unchanged)	runs, success, no evidence
Documentation	build	pool -> ubuntu-24.04	runs	runs, pool (unchanged)	runs
Documentation	deploy	ubuntu-latest (unchanged)	skipped	runs	skipped
Native feed (PR and push only for native/feed/** and the workflow file)	Release (ubuntu-24.04)	pool -> ubuntu-24.04	runs	runs, pool (unchanged)	not triggered
Native feed	Release (ubuntu-24.04-arm)	hosted (unchanged)	runs	runs	not triggered
Native feed	Release (macos-14)	hosted (unchanged)	runs	runs	not triggered
Native feed	ASan + UBSan	pool -> ubuntu-24.04	runs	runs, pool (unchanged)	not triggered
Native feed	TSan	pool -> ubuntu-24.04	runs	runs, pool (unchanged)	not triggered

Not PR-triggered and untouched: release.yml, pineforge-release.yml, release-report.yml. Nothing was moved off the PR tier, so no job gains a detection delay; the four docs-only skips still run in the post-merge push CI.

Measured PR wall time before this PR (pineforge-data, code PRs: 30 heads): median 1.2 min, p90 19.1 min, max 75.8 min. Successful attempt-1 runs, queue included, last 100 completed PR runs, optimistic. Source: /Users/haoliangwen/.local/state/pineforge/runner/ORG-CX/proof/CI-SLIM/pr-wall/README.md (84 runs for this repo; reproduced from pineforge-data.codepr.tsv: 70 s, 1149 s, 4550 s). Per workflow (same method): CI median 66 s, p90 78 s, max 2504 s (n=30); Native feed median 375 s, p90 746 s (n=6); Documentation median 23 s (n=28).

Expected after (ESTIMATE, not measured): code PR about 1.5 min on CI (hosted run 39193757764 took 76 s end to end, plus about 12 s for changes); docs-only PR about 1 min; a PR touching native/feed/** about 7.5 min (TSan is the longest job: 372 s hosted on 10-04, 429-442 s on the pool). The real numbers come from this PR's own runs and the next real PRs.

How to check. This PR runs CI, Documentation and Native feed on hosted runners. A throwaway one-line docs/index.md PR shows the docs-only path.

🤖 Generated with Claude Code