ci: build the VitePress manual on manual-only diffs (#516)

[JabbaKadabra]

Summary

Nothing in CI ran npm run docs:build for manual/. A pull request touching only manual/** skipped frontend, backend and image (all path-gated away from it) and was excluded from the e2e suite by paths-ignore, so a broken VitePress build merged green and would only surface when the release image was built — the all-in-one image's manual stage compiles the same site.

This adds a dedicated manual job to ci.yml, gated on a new manual output from the detect-changes composite action. The VitePress build takes seconds, so it is cheap to run and cheap to gate on.

Closes #516

Changes

• .github/actions/detect-changes/action.yml — new manual output, matched by ^manual/, emitted alongside backend/frontend/image.
• .github/workflows/ci.yml — new manual job: checkout, Node 24 with the npm cache keyed on manual/package-lock.json, npm ci, npm run docs:build. Gated as inputs.full || needs.changes.outputs.manual == 'true' so the release gate always runs it (per the "Adding a job to ci.yml" rule in docs/ci.md).
• The image gate deliberately still does not match manual/**: a prose edit is not worth a 30-minute packaging run when the same site builds in ~5s in the new job. That reasoning is recorded as a comment next to image_re so it is not "fixed" later.
• docs/ci.md — manual row in the what-runs-when table, updated ci.yml summary, and a fourth rule explaining why the job exists.

Verification

• YAML: both ci.yml and the composite action parse; job list is changes, secrets, frontend, manual, backend, image and the changes job exports the new manual output.
• Path gating: the regex block was exercised against synthetic file lists — manual/guide/*.md and manual/package-lock.json set manual=true with backend/frontend/image all false; docs/ci.md sets nothing; frontend/** and Proxytrace.* are unchanged from before.
• Manual build: npm ci && npm run docs:build in manual/ — build complete in 7.15s, which is exactly what the job runs.
• This PR touches .github/, which makes detect-changes fail open and force every area to true, so the new job also runs on this PR itself.
• Backend/frontend suites not run: no application code changed.
• Changelog: no entry — a CI job is not a user-facing change.

🤖 Generated with Claude Code

---

Generated by Claude Code