fix(ci): schedule Test Core on a scripts-only diff (#9829)

.github/workflows/ci.yml

@@ -38,6 +38,9 @@ jobs:
  docs: ${{ steps.changes.outputs.docs || 'true' }}
  core: ${{ steps.changes.outputs.core || 'true' }}
  console: ${{ steps.changes.outputs.console || 'true' }}
+ # Gates the `test` job ONLY, ORed with `core` — see the `scripts`
+ # filter below and the `test` job's `if:` (#9829).
+ scripts: ${{ steps.changes.outputs.scripts || 'true' }}
  # ── THE FILTER CONTRACT, both halves (#4928) ──────────────────────────
  #
  # Half 1 is the `|| 'true'` above: when in doubt, RUN EVERYTHING. It
@@ -107,6 +110,30 @@ jobs:
  - 'scripts/console-spec-probes.mjs'
  - 'scripts/assert-console-spec-injection.mjs'
  - '.github/workflows/ci.yml'
+ # Test inputs that live OUTSIDE every package (#9829). Packages whose
+ # suites read across their own boundary declare that radius in
+ # scripts/check-cross-package-test-inputs.mjs, and turbo.json mirrors each
+ # as a `$TURBO_ROOT$/…` input. SIX of those declarations are rooted at
+ # `scripts/` — @objectstack/spec (`scripts/**`), @objectstack/cli,
+ # @objectstack/metadata-protocol and create-objectstack (five single
+ # files) — and the step that pulls those packages back into the affected
+ # set, `--union-into` in the `test` job below, is a step INSIDE that job.
+ # So on a `scripts/`-only diff `core` was false, the job never started,
+ # the union never ran, and the declarations bought nothing at PR time:
+ # the merge queue was the first signal, which is the #7802 failure this
+ # whole mechanism exists to prevent. Measured with picomatch, the matcher
+ # dorny/paths-filter uses: a diff confined to
+ # `scripts/sync-template-versions.mjs` yields core=false.
+ #
+ # Deliberately a SEPARATE output rather than a widening of `core`,
+ # because it gates ONE job — the `test` job ORs it with `core`, while
+ # Build Core, Dogfood and Temporal Conformance stay filtered exactly as
+ # they are today. `scripts/**` rather than the six declared paths: the
+ # narrower filter does not exist while @objectstack/spec declares
+ # `scripts/**`, and a hand-kept list of script paths is the failure mode
+ # #7802 recorded ("a list you must remember to update").
+ scripts:
+ - 'scripts/**'
 
  test:
  # Sharded 3-way BY PACKAGE: a core-touching PR ran the affected suite
@@ -129,8 +156,11 @@ jobs:
  name: Test Core (${{ matrix.shard }}/3)
  needs: filter
  # "Skip only when the filter EXPLICITLY said no core paths changed" — see
- # THE FILTER CONTRACT on the filter job's outputs (#4928).
- if: ${{ !cancelled() && needs.filter.outputs.core != 'false' }}
+ # THE FILTER CONTRACT on the filter job's outputs (#4928). `scripts` is ORed
+ # in, never ANDed: two independent reasons to run this job, and it skips only
+ # when BOTH filters explicitly said false, so the contract's "when in doubt,
+ # RUN EVERYTHING" posture is unchanged (#9829).
+ if: ${{ !cancelled() && (needs.filter.outputs.core != 'false' || needs.filter.outputs.scripts != 'false') }}
  runs-on: ubuntu-latest
  # Backstop only — the stall guard on the test steps is the primary
  # detector for a #4250-style hang and fires well before this. 30 min is