ci(deploy-preview): preview when the pins that drive rendering change

[ExtraToast]

deploy-preview triggers on paths: ['platform/**']. The values that decide whether rendering works at all — schema-version and context-ref — live in deploy-preview.yml itself, which that filter does not cover.

So a pin bump merges with no readiness preview. Today's pin-bump PRs show it: their check list contains Workflow Lint, Repository Hygiene Guard, the language CI jobs — and no Deploy Validate.

That is not hypothetical. github-workflows v0.15.0 shipped with a context-resolution bug that made all five fragment renders fail, and the PRs that pinned it to every service repo were merged without a single render being attempted. The bug surfaced only on the next PR that happened to touch platform/.

Change

paths:
  - 'platform/**'
  - '.github/workflows/deploy-preview.yml'

The toolkit compares its own version against the context's schemaVersion with strict equality, so a mismatched pair fails loudly at render time — but only if a render is attempted. This makes it attempted whenever the pins move.

Scope and limits

This does not make the scorecard block a merge. The only required check in the ruleset is Pipeline Complete, which aggregates six ci.yml jobs; deploy-preview is a separate workflow and is not among them, so it stays advisory.

Making it required is not a one-line change either: a paths-filtered check never reports on PRs that do not match, and GitHub treats a required-but-absent check as permanently pending, which would deadlock every unrelated PR. Getting there means having the workflow always trigger and report success when there is nothing to render — a deliberate change to merge gating across seven repositories, which belongs in its own decision rather than bundled here.

[github-actions]

Deploy Preview — knowledge

Environments: production
Context ref: ghcr.io/jorisjonkers-dev/cluster-deploy-context-public@sha256:9479bc22ae11183c0b68f257d2c1a21455be8c3cff602d3a491ea3ff31d01fe3
Workloads: 2 | Routes: 1 | Gatus endpoints: 1

Image refs

• knowledge-api: ghcr.io/jorisjonkers-dev/knowledge/knowledge-api@sha256:0000000000000000000000000000000000000000000000000000000000000000
• knowledge-ingest-worker: ghcr.io/jorisjonkers-dev/knowledge/knowledge-ingest-worker@sha256:0000000000000000000000000000000000000000000000000000000000000000

SC-11 Readiness Scorecard

	Check	Status	Detail
✅	schema_pinned	pass
✅	context_pinned	pass
✅	no_latest_images	pass
✅	health_declared	pass	exempt by health.mandatory: false: knowledge-ingest-worker
✅	route_owner_authmode_declared	pass
✅	rollback_retention_acknowledged	pass
✅	no_raw_secrets	pass
✅	stateful_policy_declared	pass
➖	raw_manifests_guarded	not_applicable	no workload enables rawManifests
➖	npm_signatures_verified	not_applicable	provenance is only evaluated when publishing an artifact

pass = ready · fail = blocks deployment · not_applicable = check does not apply

➖ 2 check(s) not applicable: raw_manifests_guarded, npm_signatures_verified

---

Updated by deploy-check on push to this PR.