fix(ci): only run pr-iphone-deploy when tabatago-swift or the workflow changes

Add a paths: filter to the pull_request trigger so the iOS build+deploy
only fires when the PR actually touches:
  - tabatago-swift/**   (the iOS/watchOS app source)
  - .github/workflows/pr-iphone-deploy.yml  (this workflow itself)

PRs touching only AGENTS.md, admin-web/, youtube-worker/, supabase/,
docs/, or root config no longer spin up the macOS runner — no point
rebuilding and deploying an unchanged .app.

Including the workflow file itself in paths: ensures a PR that only
edits the workflow logic still triggers it (so this branch's own PR
will run to validate the changes).

.github/workflows/pr-iphone-deploy.yml

@@ -8,6 +8,12 @@ on:
   pull_request:
     branches: [main]
     types: [opened, synchronize, reopened]
+    # Only run the iOS build+deploy when the PR actually touches the Swift app
+    # or this workflow itself. Docs-only / backend-only / admin-web-only PRs
+    # skip the runner entirely (no point rebuilding an unchanged .app).
+    paths:
+      - 'tabatago-swift/**'
+      - '.github/workflows/pr-iphone-deploy.yml'
 
 # Every mutation (comments, merge) goes through the Gitea API with PR_API_TOKEN,
 # never the runner's native GITHUB_TOKEN — so a `permissions:` block would be