ci: run each half only when that half changes

Both jobs ran on every pull request, so a change to a Rust binary waited on a
Postgres service and a full TypeScript test run, and a change to a TypeScript
route spent a runner compiling Rust. Neither told anyone anything.

A `paths` filter belongs to a workflow rather than to a job, so the two jobs
become two workflows. That is the whole cost of the change: both job bodies are
carried over unchanged, and only the triggers differ.

The filters are written from what each job actually reads. `packages/` is
entirely TypeScript so it is taken whole, and the two TypeScript apps are named
because the rest of `apps/` is Rust. The Rust job takes its own directory plus
the workspace root and lockfile, which pin every version it builds against, and
nothing else — it depends on no other member of the workspace.

The failure mode of a path filter is silence: a job that does not run leaves a
green pull request. So the one thing a future change has to remember is written
where it will be read — adding a TypeScript app means adding it to that list.

.github/workflows/nesdoctor.yml

@@ -0,0 +1,48 @@
+# `nesdoctor`, and deliberately nothing else in the Rust workspace.
+#
+# The rest of the Rust half has never been under CI, so widening this to
+# `--workspace` would turn every pull request red for reasons unrelated to the
+# pull request. Widen it one member at a time, as each is made to pass — and
+# give each one its own `paths` filter when you do.
+name: nesdoctor
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    paths:
+      - "apps/nesdoctor/**"
+      # The workspace root pins every dependency version and owns the build
+      # profiles, so a change to either reaches this binary even though nothing
+      # under `apps/nesdoctor` moved. `Cargo.lock` is the resolved answer to
+      # the same question.
+      #
+      # No other member is listed because `nesdoctor` depends on no other
+      # member: its dependency tree is part of what it asks to be trusted on,
+      # and it is four external crates deep. If that ever stops being true,
+      # the crate it takes belongs here.
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/nesdoctor.yml"
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Rust toolchain
+        run: rustup toolchain install stable --profile minimal --component clippy,rustfmt --no-self-update
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: ". -> target"
+      - name: Format
+        run: cargo fmt -p nesdoctor -- --check
+      - name: Clippy
+        run: cargo clippy -p nesdoctor --all-targets -- -D warnings
+      - name: Test
+        run: cargo test -p nesdoctor
+      # Runs without touching the network, so this stays fast and cannot fail
+      # on a runner's egress rules. The network path is exercised by the
+      # release workflow's smoke test, where it belongs.
+      - name: Runs at all
+        run: cargo run -p nesdoctor -- --quiet --no-net --no-steam --json "$RUNNER_TEMP/nd.json" < /dev/null