ci: remove unused changed-file workflow boundary

[Jeremy1844]

Root cause

Four resource deployment workflows run the changed-files action twice, but no later step or job consumes either invocation's outputs. That leaves an unnecessary repository-filename processing boundary in deployment automation. These workflows already deploy their complete generated output for each matching push, so removing the unused steps preserves the intended deployment scope.

Change

• remove the two unused changed-file invocations and JSON-output setup from each affected workflow
• add a dependency-free regression that keeps all four deployment jobs in scope and rejects reintroduction of the unused boundary

Evidence

• base: 9d237dd4fb37dd1fb936e3f9649020cc43a374c8 (stage)
• regression: 0329cd8080946e12bc4461cfd576a9bf08c2dd82 — 0/4 introduced cases passed
• fix: 16864ea8626807407bea6181992fd339a111aaf0 — 4/4 introduced cases passed
• all eight repository workflows parse with exact js-yaml 4.1.0
• git diff --check, exact five-path scope, workflow-policy, protected-tree, and added-secret-pattern checks pass
• src, assets, package.json, and yarn.lock objects are unchanged from the base
• exact patch IDs match the prior audit proof while both new commits use the public noreply identity

Open-PR composition

• fix: make resource validation read-only and fail closed #76 has no path or semantic overlap; its exact merge tree passes 8/8 focused cases with this branch
• ci: fix resource workflow path filters #77 has no changed-path overlap; it is adjacent because its trigger correction names deploy-resources.yml. Its exact merge tree passes 7/7 focused cases with this branch
• ci: enforce TLS for authenticated resource writes #78 has no changed-path overlap; its exact merge tree passes 6/6 focused cases with this branch
• object-level composition with fix: make resource validation read-only and fail closed #76, ci: fix resource workflow path filters #77, and ci: enforce TLS for authenticated resource writes #78 is conflict-free in both tested orders and converges on the same tree

These are separate root causes and should remain separate pull requests.

Rollout and recovery

This changes no content, media, package, lockfile, schema, stored artifact, or user data, so no migration is required. Run secret-free pull-request policy checks before merge; do not use a stage or production deployment as the test harness. Historical workflow, token-permission, and cloud-access review remains a separate maintainer-owned task.

If deployment must be paused or another workflow change rolled back, retain this deletion/guard or disable the automation. Do not restore the unused action boundary as a rollback.