ci(.github): give doc-check 40 minutes to wait for the review chat - #29363

…29364)

doc-check started a review chat on every non-draft pull request. A
review loads the full skill context, the content guidelines, and the
cumulative diff before it can conclude anything, so a dependency bump or
a test-only change paid that cost only for the skill's own "what not to
comment on" list to produce silence. With the wait raised to 40 minutes
in #29363, such a run can also hold a runner idle for most of that.

This classifies the changed paths first and skips the review when every
changed file is in a class with no user-facing documentation surface.
Comparing the match count against the total is what makes it "every
file", so a diff that mixes a test file with a CLI flag still gets a
full review.

CI that builds, deploys, previews, or reviews the docs is carved back
out of the `.github` skip, because a change there can change the docs
themselves. The `doc-check` label and a manual dispatch bypass the skip
entirely, so a review stays forceable from the pull request.

Tier-2 and tier-3 priors move into `path-priors.md`, loaded only when
the pre-filter is inconclusive, so they cost nothing on a skipped run.

## Verification

Dry-ran the filter list against real and synthetic file lists with the
same globber the action uses.

| Pull request | Files | Outcome |
|---|---|---|
| #29309 restart action | 5 | REVIEW, 3 files outside the skip classes |
| #29363 doc-check timeout | 1 | REVIEW, `ci_docs` carve-out fires |
| #29306 Mermaid diagrams | 5 | REVIEW, 2 files outside the skip classes
|
| `go.mod` + `go.sum` | 2 | SKIP |
| Go test + React test | 2 | SKIP |
| `site/src/index.css` | 1 | SKIP |
| `cli/server.go` + its test | 2 | REVIEW |
| Regenerated CLI docs + `cli/list.go` | 2 | REVIEW |
| `.github/workflows/release.yaml` | 1 | SKIP |

`make pre-commit` passes, including `lint/actions/actionlint`.

<details>
<summary>Why the patterns use the <code>**/*</code> form</summary>

The globber treats a `**` glued to a suffix inconsistently. Verified
against picomatch with `dot: true`:

| Pattern | `coderd/database/db_test.go` | `foo_test.go` |
|---|---|---|
| `**_test.go` | no match | match |
| `**/*_test.go` | match | match |

`**.test.ts` happens to match at any depth, but `**_test.go` only
matches the repo root, so a nested Go test would have leaked through and
started a review. Every pattern in the filter uses `**/*` instead, which
behaves the same at every depth including the root.
`.github/workflows/ci.yaml` carries a related note about the same class
of bug in a different action's globber.

</details>

<details>
<summary>Implementation plan and decision log</summary>

Part of a broader restructure of the doc-check skill. The audit found
five defects: no path pre-filter, no commit scoping, duplicated rules,
no likelihood model, and no destination for adjacent docs-gap ideas.
This PR addresses the first, which is the largest token win and the
lowest risk. The remainder is tracked separately.

**Rejected: `paths-ignore` on the `pull_request` trigger.** It does
express "all changed files match" for free, which was the initial plan.
But it applies to the trigger as a whole, including `labeled` and
`ready_for_review`, so a `doc-check` label on a CSS-only pull request
would have been filtered out too and the manual override would have
silently died. A job-level filter step costs about 20 seconds of runner
time and keeps the override working, so the filter lives in the job and
the trigger is untouched.

**Rejected: negation patterns for the docs-affecting CI carve-out.**
`!`-prefixed patterns inside the `nodocs` filter would have made the
result depend on pattern order. A separate `ci_docs` filter that must be
empty is explicit and reads as what it means.

**Deliberately not skipped: `coderd/database/migrations/`.** A migration
alone has no user surface, but migrations usually ship next to an API
change, and the all-files-must-match rule already handles that case.
Left to the agent rather than hardcoded either way.

**Known limitation.** A user-facing default change can hide inside an
otherwise-skippable path. The all-files-must-match rule plus the label
override is the mitigation; a path-only gate cannot close this
completely.

**Follow-ups this does not do.** Commit-scoped incremental reviews, a
`concurrency` block, splitting `SKILL.md` and deleting the rules it
restates from the content guidelines, run-outcome reporting so silence
and failure are distinguishable, and routing adjacent docs-gap ideas
into Linear.

</details>

DOCS-920

> Generated by Coder Agents on behalf of @nickvigilante.