fix(ci): run every present language on schedule/dispatch in reusable-ci

[jdfalk]

Problem

detect-changes used base: github.event.pull_request.base.sha || github.event.before || github.sha. On schedule and workflow_dispatch there is no before, so the run compared the head commit with itself. Every category came back unchanged and every language job skipped. audiobook-organizer's nightly.yml skipped Go CI on 5 of 5 scheduled runs checked, so its full non-short race suite never ran nightly.

Fix

• New input force-all (string, default 'auto'). 'auto' forces on schedule/workflow_dispatch and diffs otherwise. 'true' always forces, 'false' always diffs, and any other value fails the job.
• A forced run inventories tracked files (git ls-files with :(glob) pathspecs) against the same filters, so only categories the repo contains report true.
• Three categories gate on the job's entry point instead of any matching file. A fixture or a tool-config file is not a project:
  • rust_files needs a root Cargo.toml.
  • frontend_files needs <gha-get-frontend-config dir>/package.json.
  • python_files needs a root package: pyproject.toml with [project]/[build-system], setup.py, setup.cfg, or requirements.txt.
• The filters are defined once in CHANGE_FILTERS, and both paths read them. The inventory parser fails on any line it cannot parse.
• The summary prints which mode ran. detect-changes exposes a force-all output.
• workflow-lint/workflow-scripts drop their own workflow_dispatch bypass, since the forced inventory covers that case.

Verified on real runners (forced via workflow_dispatch on this branch)

• github-common: Go, Python and Workflow Lint pass. Rust and Frontend are now skipped; before the entry-point gate both failed on testdata/rust/Cargo.toml and a root package.json with no web/. Workflow Scripts fails on pre-existing ruff debt in .github/scripts (411 findings). That job already ran on every manual dispatch through the removed bypass. The fix is a separate PR.
• audiobook-organizer nightly (pinned to this branch with force-all: 'true'): Go CI, Frontend CI (with E2E), Workflow Lint and Workflow Scripts run. Python CI is now gated off, because its pyproject.toml is black config only and failed at pip install -e ..

Caller impact

Caller	Ref	Effect
github-common ci.yml (weekly schedule + dispatch)	local	widens to Go, Python, workflow lint/scripts
cockroach-rollout-agent ci.yml (dispatch)	@main	manual dispatch runs rust-ci (root Cargo.toml + src/main.rs)
audiobook-organizer nightly.yml	SHA pin	changes on bump; sets force-all: 'true'
burndown-runner-image, magnet-handler, migrate-loop	SHA pin	none until they bump
subtitle-manager, ubuntu-autoinstall-agent	own local copy	none

Known gap, not changed here: diff mode has the same fixture false positive. A PR touching only testdata/rust/*.rs would still start rust-ci.

🤖 Generated with Claude Code

https://claude.ai/code/session_017MtQ5LP2n3t3bs7AhptkKJ