ci(deploy-runner,deploy-api): never skip build+deploy on push (force-push edge)

Both workflows previously fell through to a 'workflow only — SKIP
build + deploy' branch when dorny/paths-filter saw an empty diff
against github.event.before. That assumption — empty diff → safe
to skip — breaks on a force-push rebase, where event.before is the
previous force-push head (also has the fix) but the actually-deployed
binary on Tokyo is from an older state without it. Result: validate's
head commit advertises 'fix(runner): ...' but the Tokyo runner serves
the old binary, and test_exec_on_stopped_box_is_typed_error keeps
returning 500 'Handle invalidated after stop()' even though apps/
runner/pkg/api/controllers/boxlite_exec.go on the head clearly has
the IsStopped / IsInvalidState classification.

Always build + deploy on every push (or non-push event). The
libboxlite_changed signal in deploy-runner stays narrowed because it
controls whether build_c_sdk rebuilds .a from source vs fetches the
tagged-release tarball — that optimization is still safe to gate.
The redeploy_current and prev_run_id short-circuits also still apply.

Author: G4614

.github/workflows/deploy-api.yml

@@ -135,19 +135,22 @@ jobs:
           fi
           echo "redeploy_current=false"     >> "$GITHUB_OUTPUT"
 
+          # NEVER fall through to a no-build branch — a force-push rebase
+          # produces an empty diff vs. github.event.before even when the
+          # actually-deployed Api image is stale, and the previous "workflow
+          # only — skip" decision then left Tokyo on the older image while
+          # the head commit advertised the fix. Always build + deploy on
+          # any push (or non-push event). The redeploy_current short-circuit
+          # above still applies when explicitly requested.
           if [ "${{ github.event_name }}" != 'push' ]; then
               echo "Non-push event (${{ github.event_name }}) — build + deploy."
-              echo "should_build=true"   >> "$GITHUB_OUTPUT"
-              echo "should_deploy=true"  >> "$GITHUB_OUTPUT"
           elif [ "${PUSH_CHANGED:-false}" = 'true' ]; then
               echo "Push touched api_source paths — build + deploy."
-              echo "should_build=true"   >> "$GITHUB_OUTPUT"
-              echo "should_deploy=true"  >> "$GITHUB_OUTPUT"
           else
-              echo "Push only touched workflow files — SKIP build + deploy."
-              echo "should_build=false"  >> "$GITHUB_OUTPUT"
-              echo "should_deploy=false" >> "$GITHUB_OUTPUT"
+              echo "Push didn't touch api_source paths — build + deploy anyway (avoid stale Tokyo on rebase)."
           fi
+          echo "should_build=true"   >> "$GITHUB_OUTPUT"
+          echo "should_deploy=true"  >> "$GITHUB_OUTPUT"
 
   # ── Deploy: ECR push (optional) + ECS register-TD + UpdateService ─
   deploy:

.github/workflows/deploy-runner.yml

@@ -177,22 +177,25 @@ jobs:
           fi
 
           # Push branch: gate each stage on the narrowest change-set
-          # that affects its inputs.
+          # that affects its inputs. NEVER fall through to a no-build
+          # branch — force-push rebases produce an empty diff vs.
+          # github.event.before even when the actually-deployed binary
+          # is now stale, and a "workflow only — skip" decision then
+          # leaves Tokyo on the older runner while the head commit
+          # advertises the fix. Always build + deploy on push; only
+          # the libboxlite_changed signal stays narrowed (it controls
+          # whether build_c_sdk rebuilds .a from source vs. fetches
+          # the tagged-release tarball).
           if [ "${LIBBOXLITE_CHANGED:-false}" = 'true' ]; then
               echo "Push touched libboxlite_chain — rebuild .a + runner + deploy."
               echo "should_build=true"        >> "$GITHUB_OUTPUT"
               echo "should_deploy=true"       >> "$GITHUB_OUTPUT"
               echo "libboxlite_changed=true"  >> "$GITHUB_OUTPUT"
-          elif [ "${GO_RUNNER_CHANGED:-false}" = 'true' ]; then
-              echo "Push touched go_runner_chain only — reuse release libboxlite.a, rebuild runner + deploy."
+          else
+              echo "Push didn't touch libboxlite_chain — reuse release libboxlite.a, rebuild runner + deploy."
               echo "should_build=true"        >> "$GITHUB_OUTPUT"
               echo "should_deploy=true"       >> "$GITHUB_OUTPUT"
               echo "libboxlite_changed=false" >> "$GITHUB_OUTPUT"
-          else
-              echo "Push only touched workflow files — SKIP build + deploy."
-              echo "should_build=false"       >> "$GITHUB_OUTPUT"
-              echo "should_deploy=false"      >> "$GITHUB_OUTPUT"
-              echo "libboxlite_changed=false" >> "$GITHUB_OUTPUT"
           fi
 
   # ── Build libboxlite.a from THIS checkout's Rust source ────────────