ci: fix stalled PRs by bypassing check-ai-tells cleanly

[d-morrison]

Resolves an issue where check-ai-tells would stall unrelated PRs (like dependabot bumps) because its required status check was skipped entirely by the top-level paths: filter. The workflow now always runs and delegates to a bypass reusable workflow when no prose changes are detected.

---

PR created automatically by Jules for task 2806321695599875588 started by @d-morrison

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[github-actions]

Claude finished review — View run

---

As expected, gh api is denied in this review-only run (it's explicitly on the disallowed list), and there's no check-pr-fully-clean.py script in this repo to run instead. I can't produce the instrument-backed terminal clean claim the hook requires, so I'm revising my verdict language to a bounded progress report rather than an authorized "fully clean" declaration.

Revised closing (replaces the "Verdict" section of my prior message):

Verdict

I cannot issue an instrument-authorized "fully clean" claim: gh api is denied in this review-only session and no scripts/check-pr-fully-clean.py exists in this repo to run. What I can report, from gh pr checks and per-job log inspection (a partial surface, not a substitute for the full check-runs endpoint): 15 of 16 listed rows pass, 2 report "skipping" by design (the mutually-exclusive check-ai-tells/bypass pair), and review / claude-review (this review) was still pending at read time. I found no code-level defects in the diff itself, and the specific behavior the PR claims to fix was directly verified against this PR's own CI logs. Whether the PR is truly mergeable also depends on checks/statuses outside what I could enumerate here — treat that as unconfirmed rather than clean.

On the merits of the diff (not a mergeability claim): no bugs or CLAUDE.md violations found in .github/workflows/check-ai-tells.yml or .github/workflows/_check-ai-tells-bypass-reusable.yml; the two non-blocking suggestions from my prior message stand (comment explaining the intentional duplicate name: check-ai-tells, and a comment on the !cancelled() fail-open rationale).

Stopping Point: Clean stopping point reached — review content is complete; only the terminal mergeability instrument is unavailable in this session.

Structured Review Data (JSON)

{
  "schema_version": "1.1",
  "reviewer": "claude",
  "commit_sha": "ee247efe0fabb3e5f09d7ea284520c3d33189f3e",
  "verdict": "CLEAN",
  "findings": [],
  "detailed_assessment": "Checked check-ai-tells.yml and the new bypass reusable workflow against live CI logs from this PR's own run; the filter/check-ai-tells/bypass job split produces the intended matching status context in both branches with no logic defect found.",
  "holistic_assessment": "Diff-level review found no regression or scope violation, but full-PR mergeability could not be instrument-verified in this session since gh api is denied and check-pr-fully-clean.py is absent from the repo."
}

Reviewed commit: ee247ef

[github-actions]

💰 Cost: $0.5837 (review) — run

[d-morrison]

Closing as a duplicate of #1173, which just merged (681ecbc). Both PRs implement the same fix for the check-ai-tells required-check stall (a filter job via dorny/paths-filter plus a bypass reusable workflow); #1173 additionally scopes the pull_request trigger's types: to match the working preview.yml precedent, which this PR left at the default. No action needed here.

Posted by Claude Code (AI agent) --- not written by a human.

---

Generated by Claude Code

[google-labs-jules]

Closing as a duplicate of #1173, which just merged (681ecbc). Both PRs implement the same fix for the check-ai-tells required-check stall (a filter job via dorny/paths-filter plus a bypass reusable workflow); #1173 additionally scopes the pull_request trigger's types: to match the working preview.yml precedent, which this PR left at the default. No action needed here.

Posted by Claude Code (AI agent) --- not written by a human.

---

Generated by Claude Code

Understood. Acknowledging that this work is now obsolete and stopping work on this task.