[eric] ci: drop macOS legs and gate the packaged-app build on artifact paths

- e2e + dogfood matrices are now windows-latest only: GitHub's scarce mac
  runners left the macos legs perpetually queued/starved and they surfaced
  mac-only failures untriageable from the Windows dev box, so the whole
  matrix read red
- remove the now-dead macOS build steps; re-add macos-14/macos-13 (matrix
  edit + workflow_dispatch) when a Mac maintainer can own them
- gate the expensive build on artifact-affecting paths only (electron,
  frontend, backend, e2e, build+ci scripts) plus PRs to main + dispatch;
  cheap hermetic gates still run on every push
- verify-release-readiness defaults to --require win32 so the removed darwin
  leg does not block every v* tag forever

.github/workflows/dogfood.yml

@@ -12,8 +12,19 @@ name: Dogfood (preflight verdict vs reality)
 on:
   schedule:
     - cron: '0 */2 * * *'   # every 2 hours; 12 runs/day; 12 consecutive clean ~= 24h of dogfood
+  # The cron is the readiness-accumulation engine. The push trigger is gated to
+  # artifact-affecting code only (not docs/gitignore/CI-meta), so a trivial push
+  # does not spend a full packaged-app build + dogfood matrix.
   push:
     branches: [eric/lock]
+    paths:
+      - 'electron/**'
+      - 'frontend/**'
+      - 'backend/**'
+      - 'scripts/build-app**'
+      - 'scripts/fetch-router**'
+      - 'scripts/ci/**'
+      - '.github/workflows/dogfood.yml'
   workflow_dispatch:
 
 permissions:
@@ -25,7 +36,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest, macos-13, macos-14]
+        # Windows-only. macOS legs removed: runner starvation + untriageable
+        # mac-only failures kept the matrix red. Re-add when a Mac maintainer
+        # owns them (and pass --require win32,darwin to verify-release-readiness).
+        os: [windows-latest]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     env:
@@ -40,15 +54,9 @@ jobs:
         with: { python-version: '3.13' }
 
       - name: Build packaged app (Windows)
-        if: startsWith(matrix.os, 'windows')
         shell: pwsh
         run: pwsh -NoProfile -File scripts/build-app-win.ps1
 
-      - name: Build packaged app (macOS)
-        if: startsWith(matrix.os, 'macos')
-        shell: bash
-        run: bash scripts/build-app.sh
-
       - name: Dogfood run (verdict vs reality cross-check)
         shell: bash
         run: node scripts/ci/verify-dogfood.js --manifest scripts/ci/dogfood-manifest.jsonl

.github/workflows/e2e.yml

@@ -1,4 +1,4 @@
-name: E2E (packaged app, mac + win)
+name: E2E (packaged app, Windows)
 
 # Builds the UNSIGNED packaged app on each OS, then runs the FULL deterministic
 # gate against the real artifact plus the Playwright smoke. Signing/notarization +
@@ -18,17 +18,36 @@ name: E2E (packaged app, mac + win)
 #      prior install, so the real install -> verify -> uninstall cycle is safe here
 #      (it refuses to run where an install already exists).
 #
-# Matrix: windows-latest (Win Server 2022) + macos-13 (Intel x64) + macos-14
-# (Apple Silicon) for arch+OS-version span, pinned for reproducibility. GitHub
-# retired windows-2019 and ships no Win10 client image, so true Win10 coverage
-# needs the SELF-HOSTED e2e-win10 job (activates when a runner labeled
-# [self-hosted, windows, win10] exists and repo var WIN10_SELF_HOSTED=true).
+# Matrix: windows-latest (Win Server 2022) only. The macOS legs were removed -
+# GitHub's scarce mac runners left them perpetually queued/starved and surfaced
+# mac-only failures we cannot triage from the Windows dev box, so the whole
+# matrix read red. Re-add macos-14/macos-13 (matrix edit + workflow_dispatch)
+# when a Mac maintainer can own them. GitHub retired windows-2019 and ships no
+# Win10 client image, so true Win10 coverage needs the SELF-HOSTED e2e-win10 job
+# (activates when a runner labeled [self-hosted, windows, win10] exists and repo
+# var WIN10_SELF_HOSTED=true).
 
 on:
+  # This is the EXPENSIVE leg (packaged-app build + e2e matrix). Gate it so it only
+  # runs when code that actually affects the built artifact changes - not docs,
+  # .gitignore, or unrelated CI meta - plus on PRs into main and on demand. The
+  # cheap gates (hermetic phase-tests, gitleaks) keep running on every push via
+  # their own workflows, so every push still gets fast signal.
   push:
     branches: [eric/lock]
-    paths-ignore: ['**.md', 'docs/**', '.gitleaksignore']
+    paths: &build-paths
+      - 'electron/**'
+      - 'frontend/**'
+      - 'backend/**'
+      - 'e2e/**'
+      - 'scripts/build-app**'
+      - 'scripts/fetch-router**'
+      - 'scripts/build-python-env**'
+      - 'scripts/ci/**'
+      - '.github/workflows/e2e.yml'
   pull_request:
+    branches: [main]
+    paths: *build-paths
   workflow_dispatch:
 
 permissions:
@@ -39,7 +58,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [windows-latest, macos-13, macos-14]
+        # Windows-only. macOS legs removed: runner starvation + untriageable
+        # mac-only failures kept the matrix red. Re-add macos-14/macos-13 here
+        # (with workflow_dispatch) when a Mac maintainer can own them.
+        os: [windows-latest]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 90
     env:
@@ -95,15 +117,9 @@ jobs:
         run: node scripts/ci/verify-preflight.js
 
       - name: Build packaged app (Windows)
-        if: startsWith(matrix.os, 'windows')
         shell: pwsh
         run: pwsh -NoProfile -File scripts/build-app-win.ps1
 
-      - name: Build packaged app (macOS)
-        if: startsWith(matrix.os, 'macos')
-        shell: bash
-        run: bash scripts/build-app.sh
-
       - name: Deterministic gate (verify-all)
         shell: bash
         run: node scripts/ci/verify-all.js