Record PR #466's per-surface CI gating as an extractable primitive

[WilfordGrimley]

Description

Owner-directed, records PR #466's CI scoping. PR #466 (merged 2026-07-25) added a changes job to .github/workflows/web-ci.yml that does a plain git diff --name-only against the push's pre-image SHA (no third-party paths-filter action), gating test-backend/test-frontend/merge-frontend-test-reports/build-frontend behind per-job if: conditions so a backend-only merge no longer runs the full 4-shard Playwright suite (and vice versa).

Verified by reading .github/workflows/web-ci.yml on master directly: pure workflow YAML + plain git diff/grep, zero cardpicker.*/vote-system/consensus/auth reference — qualifies as CLEAN. Added one row + a detail note to docs/upstreaming/extractable-primitives.md's "Docs tooling & federation" table, marked pattern-level (the job/path names are fork-specific; the changes-job + if:-wiring shape is what generalizes), same precedent as the existing "Eager-WASM lazy-mount fix" and "Deterministic snapshot-test sequencing" rows. The note also distinguishes this from coverage-delta.yml, which deliberately stays unfiltered per its own header comment (issue #415/incident #389) — not a second instance of the pattern, not an oversight.

docs/upstreaming/conventions.md's "CI for the ladder" section was checked but NOT edited: that section describes upstream-branch-verification.yml/upstream-drift-monitor.yml, which trigger only via schedule/workflow_dispatch and always run the full pre-commit + backend pytest suite regardless of surface — web-ci.yml's per-surface gating never applies to them (upstream-fix-/upstream-feat- branches aren't pushed to master and don't carry the workflow file at all). Adding "upstream branches inherit path-scoped CI" there would misstate the mechanism, so this file was left untouched.

Checklist

• docs/upstreaming/extractable-primitives.md — new row + detail note for the per-surface CI gating pattern, judged CLEAN by hand (the mechanical tether only parses .py/.ts/.tsx files, so a .yml row isn't covered by it)
• docs/upstreaming/conventions.md — reviewed, deliberately not edited (see Description)
• python3 .github/scripts/docs_lint.py --strict — clean
• python3 .github/scripts/tests/test_docs_lint.py — 26 passed
• python3 .github/scripts/tests/test_publish_wiki_link_rewrite.py — 4 passed
• python3 .github/scripts/tests/test_publish_readme.py + regenerate-and-diff — 8 passed, no drift
• python3 .github/scripts/tests/test_check_protected_core_license.py + check_protected_core_license.py — clean
• npx prettier@2.7.1 --check / pre-commit run --all-files — clean

Not a policy/wiki-published page — no "Last updated" marker to bump.