fix(ci): replace trigger-level paths: with dorny/paths-filter (Gitea ignores on.pull_request.paths)

Gitea Actions does not reliably honor `on.pull_request.paths:` filters —
the workflow silently fails to trigger even when changed files match the
filter. PR #13 touches .github/workflows/pr-iphone-deploy.yml (explicitly
listed in the paths filter) and AGENTS.md, but only ci.yml fired.

The repo history shows this was already known: 65d85b6 'remplacer paths
trigger par dorny/paths-filter' moved to job-level filtering, but later
commits reverted to the trigger-level paths: block. The proven-working
pattern already lives in ci.yml (dorny/paths-filter@v3 in a 'changes' job).

Fix (mirror ci.yml):
- Remove trigger-level `paths:` from on.pull_request.
- Add a 'changes' job (ubuntu-latest, dorny/paths-filter@v3, single 'ios'
  filter covering tabatago-swift/** and the workflow itself).
- Gate build-deploy: needs: changes + if: needs.changes.outputs.ios == 'true'.
- Gate wait-approval: if: needs.build-deploy.result == 'success' so a
  filtered-out deploy doesn't launch a merge poll against an undeployed PR.

Everything else unchanged: concurrency, squash-merge, 2h timeout, the
self-merge fix from the previous commit on this branch (sentinel marker
+ python3 parser). This PR will self-validate: it touches the workflow
file, so the ios filter matches, so the deploy runs.

.github/workflows/pr-iphone-deploy.yml

@@ -8,12 +8,11 @@ on:
   pull_request:
     branches: [main]
     types: [opened, synchronize, reopened]
-    # Only run the iOS build+deploy when the PR actually touches the Swift app
-    # or this workflow itself. Docs-only / backend-only / admin-web-only PRs
-    # skip the runner entirely (no point rebuilding an unchanged .app).
-    paths:
-      - 'tabatago-swift/**'
-      - '.github/workflows/pr-iphone-deploy.yml'
+    # NOTE: no trigger-level `paths:` here — Gitea Actions does not reliably
+    # honor `on.pull_request.paths:` filters (the workflow silently fails to
+    # trigger even when changed files match). Path gating is done at the job
+    # level via dorny/paths-filter@v3 in the `changes` job below (same pattern
+    # as ci.yml). Docs/backend-only PRs then skip the macOS runner.
 
 # Every mutation (comments, merge) goes through the Gitea API with PR_API_TOKEN,
 # never the runner's native GITHUB_TOKEN — so a `permissions:` block would be
@@ -26,8 +25,29 @@ concurrency:
 
 jobs:
 
+  # ── Path filter — determines whether the macOS build+deploy is worth running ──
+  # Gitea Actions does not honor trigger-level `on.pull_request.paths:`, so we
+  # gate at the job level with dorny/paths-filter (same pattern as ci.yml).
+  changes:
+    name: Detect Changes
+    runs-on: ubuntu-latest
+    outputs:
+      ios: ${{ steps.filter.outputs.ios }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            ios:
+              - 'tabatago-swift/**'
+              - '.github/workflows/pr-iphone-deploy.yml'
+
   build-deploy:
     name: Build & Deploy to iPhone (devicectl)
+    needs: changes
+    if: needs.changes.outputs.ios == 'true'
     runs-on: macos
     timeout-minutes: 30
 
@@ -187,6 +207,10 @@ jobs:
   wait-approval:
     name: Wait for LGTM comment
     needs: build-deploy
+    # Only run when build-deploy actually deployed. Without this, a skipped
+    # build-deploy (filtered out by `changes`) would still launch this job and
+    # the merge poll would run against a PR that was never deployed to device.
+    if: needs.build-deploy.result == 'success'
     runs-on: macos
     timeout-minutes: 120