ci: run each half only when that half changes

Both jobs ran on every pull request, so a change to a Rust binary waited on a
Postgres service and a full TypeScript test run, and a change to a TypeScript
route spent a runner compiling Rust. Neither told anyone anything.

A `paths` filter belongs to a workflow rather than to a job, so the two jobs
become two workflows. That is the whole cost of the change: both job bodies are
carried over unchanged, and only the triggers differ.

The filters are written from what each job actually reads. `packages/` is
entirely TypeScript so it is taken whole, and the two TypeScript apps are named
because the rest of `apps/` is Rust. The Rust job takes its own directory plus
the workspace root and lockfile, which pin every version it builds against, and
nothing else — it depends on no other member of the workspace.

The failure mode of a path filter is silence: a job that does not run leaves a
green pull request. So the one thing a future change has to remember is written
where it will be read — adding a TypeScript app means adding it to that list.

.github/workflows/nesdoctor.yml

@@ -0,0 +1,48 @@
+# `nesdoctor`, and deliberately nothing else in the Rust workspace.
+#
+# The rest of the Rust half has never been under CI, so widening this to
+# `--workspace` would turn every pull request red for reasons unrelated to the
+# pull request. Widen it one member at a time, as each is made to pass — and
+# give each one its own `paths` filter when you do.
+name: nesdoctor
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    paths:
+      - "apps/nesdoctor/**"
+      # The workspace root pins every dependency version and owns the build
+      # profiles, so a change to either reaches this binary even though nothing
+      # under `apps/nesdoctor` moved. `Cargo.lock` is the resolved answer to
+      # the same question.
+      #
+      # No other member is listed because `nesdoctor` depends on no other
+      # member: its dependency tree is part of what it asks to be trusted on,
+      # and it is four external crates deep. If that ever stops being true,
+      # the crate it takes belongs here.
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/nesdoctor.yml"
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Rust toolchain
+        run: rustup toolchain install stable --profile minimal --component clippy,rustfmt --no-self-update
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: ". -> target"
+      - name: Format
+        run: cargo fmt -p nesdoctor -- --check
+      - name: Clippy
+        run: cargo clippy -p nesdoctor --all-targets -- -D warnings
+      - name: Test
+        run: cargo test -p nesdoctor
+      # Runs without touching the network, so this stays fast and cannot fail
+      # on a runner's egress rules. The network path is exercised by the
+      # release workflow's smoke test, where it belongs.
+      - name: Runs at all
+        run: cargo run -p nesdoctor -- --quiet --no-net --no-steam --json "$RUNNER_TEMP/nd.json" < /dev/null

.github/workflows/web.yml

@@ -1,12 +1,35 @@
-name: CI
+# The TypeScript half: the control-plane apps and the packages they share.
+#
+# Split from the Rust half rather than being two jobs in one workflow, because
+# a job cannot carry its own `paths` filter — only a workflow can. Two files is
+# what "run this only when its own code changes" costs, and the alternative
+# spends a runner on every pull request deciding it has nothing to do.
+name: web
 
 on:
   push:
     branches: [main]
   pull_request:
+    paths:
+      # Every TypeScript workspace member. `packages/` is entirely TypeScript
+      # so it is taken whole; `apps/` is mostly Rust, so its two members are
+      # named. **Adding a TypeScript app means adding it here** — nothing
+      # detects that on its own, and the failure is silent: the tests do not
+      # run and the pull request goes green.
+      - "apps/api/**"
+      - "apps/auth/**"
+      - "packages/**"
+      # The workspace itself. A lockfile change reaches every member, and the
+      # linter and compiler settings decide whether any of it passes.
+      - "package.json"
+      - "bun.lock"
+      - "tsconfig.json"
+      - "oxlintrc.json"
+      # This file. A change to how the tests run is a change worth running.
+      - ".github/workflows/web.yml"
 
 jobs:
-  web:
+  test:
     runs-on: ubuntu-latest
     services:
       postgres:
@@ -42,28 +65,3 @@ jobs:
         run: bun test
         env:
           TEST_DATABASE_URL: postgres://postgres:postgres@localhost:5432/nestri
-
-  # Scoped to `nesdoctor` deliberately. The rest of the Rust half has never
-  # been under CI, so widening this to `--workspace` would turn every PR red
-  # for reasons unrelated to the PR. Widen it one member at a time, as each is
-  # made to pass.
-  nesdoctor:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Rust toolchain
-        run: rustup toolchain install stable --profile minimal --component clippy,rustfmt --no-self-update
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: ". -> target"
-      - name: Format
-        run: cargo fmt -p nesdoctor -- --check
-      - name: Clippy
-        run: cargo clippy -p nesdoctor --all-targets -- -D warnings
-      - name: Test
-        run: cargo test -p nesdoctor
-      # Runs without touching the network, so this stays fast and cannot fail
-      # on a runner's egress rules. The network path is exercised by the
-      # release workflow's smoke test, where it belongs.
-      - name: Runs at all
-        run: cargo run -p nesdoctor -- --quiet --no-net --no-steam --json "$RUNNER_TEMP/nd.json" < /dev/null