ci(cmux-tui): skip docs-only publishes while preserving artifact lookup
Leo: "we just need the nightlies bro". Docs-only changes under cmux-tui/docs/** must not trigger the R2 publisher.
The push trigger excludes that subtree and the runtime key omits it without reading parents, including shallow checkouts and merge commits. Existing v2 keys remain available as v2-legacy, and consumers still read historical v1 objects. Preflight requires the canonical docs-independent publication before it skips a build; otherwise a later docs-only push could have no readable key. Publication writes the canonical and v2-legacy keys.
This repairs the compatibility mismatch found by independent review of #28184. The retry workflow keeps its workflow_run trigger. Related design: https://github.com/manaflow-ai/cmuxterm-hq/issues/5123#issuecomment-6515215902 and https://github.com/manaflow-ai/cmuxterm-hq/issues/4946.
Validation: 90 workflow/security/retry tests; tree-key-v2 (docs-only, mixed changes, merge, depth-one checkout, v1 and old-v2 lookup); tree-publish-v2 (real workflow publication step); embedded-input coverage (191 files); git diff --check. Risk: the new canonical key requires one publication even when old compatibility objects already exist. No permissions or secrets change.
Agent session: agent session