Fix CI gating: VERSION deploy-only, docs no longer skip deploy

Three bugs in path-based CI gating:
- VERSION and scripts/* triggered frontend+backend tests unnecessarily;
  now classified as deploy-only (scripts/db-* still matches as BE)
- docs-only changes skipped build-and-deploy, but docs are served
  in-app by the Docs surface — every change needs a deploy
- Updated path gating comment block and pipeline header to match

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -1,6 +1,6 @@
 # .gitea/workflows/ci.yaml
 # ============================================
-# Armature - CI/CD Pipeline (v0.17.3)
+# Armature - CI/CD Pipeline (v0.18.0)
 # ============================================
 # Single unified image (Go backend + nginx frontend).
 # v0.1.0: Dropped FE/BE image split per ROADMAP design decision.
@@ -10,8 +10,9 @@
 #   1a. Frontend tests   — skipped if only BE/docs/packages changed
 #   1b. Go unit tests    — all non-DB packages + SQLite integration (race-enabled)
 #   1c. Go test (PG)     — PG store + handlers against Postgres (race-enabled)
-#   1d. Test runners     — disabled until v0.7.5 (Playwright headless fix)
+#   1d. Test runners     — re-enabled v0.7.5 (any code change triggers)
-#   2.  Build + Deploy   — skipped if docs-only change
+#   1e. E2E smoke        — Playwright navigation smoke test against every surface
+#   2.  Build + Deploy   — always runs (docs are served in-app)
 #
 # Test coverage mapping (no package tested by zero jobs):
 #   Unit packages (auto-discovered)   → test-sqlite  (race)
@@ -24,11 +25,11 @@
 # Path gating rules:
 #   src/, src/editor/          → frontend tests
 #   server/, scripts/db-*      → backend tests (PG + SQLite)
-#   packages/                  → test-runners (surface/extension tests)
+#   packages/                  → test-runners + e2e-smoke
 #   Dockerfile*, k8s/, .gitea/ → all tests (infra change)
 #   ci/                        → infra (CI scripts)
-#   docs/, *.md                → skip all tests + deploy
+#   docs/, *.md                → build-and-deploy only (docs served in-app)
-#   VERSION, scripts/*         → frontend + backend tests
+#   VERSION, scripts/*         → build-and-deploy only (no tests)
 #   Tags (v*)                  → always full pipeline
 #
 # Deployment mapping (single domain, path-based):
@@ -156,7 +157,7 @@ jobs:
               docs/*|*.md|CHANGELOG.md|LICENSE)
                 DOCS=true ;;
               VERSION|scripts/*)
-                FE=true; BE=true ;;
+                DOCS=true ;;  # deploy-only — scripts/db-* already matched as BE above
               ci/*)
                 INFRA=true ;;
               *)
@@ -416,15 +417,15 @@ jobs:
   # Depends on all test jobs. Skipped jobs (due to path gating)
   # are treated as successful — no blocking.
   #
-  # Skipped entirely for docs-only changes (nothing to build).
+  # Always runs — docs are served in-app by the Docs surface.
   build-and-deploy:
     runs-on: ubuntu-latest
     needs: [detect-changes, test-go-pg, test-frontend, test-sqlite, test-runners]
-    # Run unless: a needed job failed, the workflow was cancelled, or it's docs-only.
+    # Run unless: a needed job failed or the workflow was cancelled.
     # Skipped test jobs (path-gated) are fine — they don't block.
+    # Always deploys — docs are served in-app, VERSION needs a build.
     if: |
-      !cancelled() && !failure() &&
+      !cancelled() && !failure()
-      needs.detect-changes.outputs.docs_only != 'true'
     steps:
       - name: Checkout
         uses: actions/checkout@v4