CI hygiene: fix perf-gate path filters and add docs phantom path check

[IanFrelinger]

Summary

Streamline CI to eliminate path-touch workarounds and docs-guard bounce loops, plus audit and document which checks are safe to require as branch-protection checks.

Changes

1. perf-gate path filter expansion

• perf-gate.yml: Added src/Ashlar.Infrastructure/**, src/Ashlar.Core.Application/**, src/Ashlar.Core.Domain/**, and src/Ashlar.Orchestration/** to path filters
  • Infrastructure changes (e.g. ALLOW_MOCK adapters) now trigger perf-gate-tier-b without needing to touch scripts/perf-gate*.sh
  • Eliminates the workaround of touching scripts to force CI runs

2. Local docs phantom path check

• scripts/check-docs-phantom-paths.sh: New lightweight local check that mirrors the onboarding-docs-guard "Referenced repo paths must exist" logic
  • Catches phantom backtick-wrapped paths (like `src/Ashlar.Forge/...`) before PR CI fails
  • Excludes placeholders (e.g. <name>, {a,b}) and git-ignored paths
  • Provides fast feedback loop for doc authors
• CONTRIBUTING.md: Added the new script to the "Required pre-PR checks" section

3. Safe-to-require check audit (CEO follow-up)

• CiGateInventory.md: Corrected inventory — shell-lint and docs-link-check have NO path filters and already always report
  • Added "Checks that are safe to require" table with exact check names for branch protection
  • Both workflows were already correctly configured; no YAML changes needed
  • Updated trigger map counts: 5 unfiltered PR workflows (was incorrectly 3)
  • Updated branch protection snippet with commented examples
• CONTRIBUTING.md: Added note about which additional checks are safe to require

Testing

Verified that:

• bash scripts/check-docs-phantom-paths.sh runs successfully on the current codebase (0 missing paths)
• The script correctly excludes itself (avoiding false positives from example paths in comments)
• The script matches the pattern and logic from .github/workflows/onboarding-docs-guard.yml lines 82-113
• perf-gate.yml syntax is valid
• Audited shell-lint.yml and docs-link-check.yml triggers: both have pull_request: with NO paths: filter
• Verified exact job names for branch protection contexts

Testing strategy (blast radius)

This is a CI configuration and tooling change:

• No production code changes (CI-only)
• The new script is standalone and optional (listed in CONTRIBUTING.md)
• perf-gate.yml path filter expansion is additive only (no removals)
• Documentation updates only for safe-to-require checks (no workflow YAML changes)

Checklist

• make test not required (CI-only change)
• Documentation updated (CONTRIBUTING.md, CiGateInventory.md)
• No TODO or NotImplementedException left unresolved
• Breaking changes are documented (none)

Release (only when this PR ships a versioned NuGet/GHCR release)

• Not a versioned release — skip

Safe-to-require CI checks (exact context names)

The following checks always run on every PR (no path filters) and are safe to add as required branch-protection checks:

Exact check name (for branch protection)	Workflow file	Current status	Notes
cert-gate	cert-gate.yml	✅ Currently required	Hermetic certification gate
shell-lint	shell-lint.yml	⚠️ Advisory, safe to require	Parse + shellcheck -S error; ~5s
lychee (README + docs)	docs-link-check.yml	⚠️ Advisory, safe to require	External link validation; ~30s
verify	layer-boundary.yml	⚠️ Advisory	Kernel-first layer boundary
uat and uat cross-platform	uat-gate.yml	⚠️ Advisory	UAT smoke tests

CEO hold: Do not require shell-lint or lychee (README + docs) as branch-protection checks until this documentation is reviewed and approved. Both are already correctly configured to always report — no additional workflow changes needed.

Notes

• This PR does not weaken or skip cert-gate (the only currently required check)
• The perf-gate change makes the existing optional perf-gate more responsive to relevant changes
• The local docs check gives authors fast feedback before CI round trips
• The safe-to-require audit confirms that shell-lint and lychee are already correctly configured as always-run checks