feat(signals): expand slop path classifiers for CI, toolchain, and lockfiles

[kiannidev]

Summary

Slop path classification (src/signals/path-matchers.ts, #561) drives how changed files are categorized for padding/churn analysis. Several common CI, toolchain, and lockfile paths still fell through to generic other, so config/infra-heavy diffs were not classified as the low-effort categories they are.

This expands the deterministic matchers so those paths classify correctly before slop scoring consumes them via classifyChangedFile.

New classifications

Lockfiles: deno.lock, bun.lock, pubspec.lock, Podfile.lock

Dependency manifests: deno.json, deno.jsonc, pubspec.yaml, mix.exs, go.work, uv.toml

Config / CI / toolchain:

• GitHub Actions workflows (.github/workflows/*.yml), Dependabot, CircleCI config
• .gitlab-ci.yml, Jenkinsfile, azure-pipelines.yml
• mise.toml, .tool-versions, Taskfile.yml, justfile, Caddyfile, docker-compose.yml
• Repo policy/automation: .pre-commit-config.yaml, .gitleaks.toml, .gittensory.yml, codecov.yml, renovate.json, deploy configs (railway.json, vercel.json, netlify.toml), cliff.toml
• Test/lint prefixes: playwright.config.*, eslint.config.*

Behavior notes

• Config/lockfile paths are not treated as non-substantive padding (by design — dependency bumps and CI maintenance are legitimate). This improves category accuracy for downstream slop analysis and any tooling that reads classifyChangedFile.
• CI workflow detection is directory-scoped (.github/workflows/, .circleci/config.yml) so arbitrary docs/ci.yml files are not misclassified.

Validation

git diff --check
npm run typecheck
npm run test:coverage
npm run test:workers
npm run actionlint
npm run db:migrations:check
npm run ui:openapi:check

All pass locally on Node 22 after npm ci.

Linked issue

Fixes #1421

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@a356441). Learn more about missing BASE report.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1422   +/-   ##
=======================================
  Coverage        ?   95.39%           
=======================================
  Files           ?      193           
  Lines           ?    20933           
  Branches        ?     7566           
=======================================
  Hits            ?    19970           
  Misses          ?      383           
  Partials        ?      580           

Files with missing lines	Coverage Δ
src/signals/path-matchers.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[JSONbored]

Closing this as the later duplicate. jaso0n0818's #1261 made the same isConfigFile CI-config change — same workflow/circleci/dependabot regexes, same toolchain entries — more than a day earlier, so on the earlier-original rule #1261 wins; being a broader superset doesn't promote a later PR over the original. Your genuinely net-new entries (the lockfiles, codecov/netlify/docker-compose, the isCiConfigPath extraction) are worth keeping — resubmit them as a focused PR layered on #1261 once it lands.