docs-only: workflow_dispatch classifies only HEAD~1 on multi-commit branches

[forkwright]

Finding

The standalone docs-only.yml computes the correct full changeset for pull requests (origin/base...HEAD) and pushes (event.before..HEAD), but its workflow_dispatch fallback sees neither value and classifies only HEAD~1..HEAD.

A manually dispatched multi-commit branch whose final commit is documentation-only but whose earlier branch commits change code can therefore emit docs_only=true. A consumer such as Thumos then reports its required kernel context while skipping the build/QEMU steps for a branch that contains code changes.

Evidence

At immutable consumer pin bf948dfbfefa9b59c2d5f6b10b5eb0df3f24fb52, .github/workflows/docs-only.yml selects:

• origin/${BASE_REF}...HEAD when github.base_ref exists;
• ${EVENT_BEFORE}..HEAD when github.event.before resolves;
• otherwise HEAD~1..HEAD.

Thumos ci.yml includes workflow_dispatch and now consumes this reusable under #775. Its PR and push behavior is correct; independent review of Thumos PR #934 found this manual-dispatch-only edge.

Desired correction

For callers whose event cannot identify the complete proposed changeset, fail closed to docs_only=false, or accept an explicit trusted comparison base supplied by the caller and verify it resolves. Do not infer that a branch is docs-only from its last commit alone.

Add a fixture for a two-commit manually dispatched branch (code first, docs last) and require false; preserve the existing PR merge-base and push-before cases. Until fixed, callers may disable the exemption on workflow_dispatch.