fix(ci): the release gate is exercised when the release gate changes (WOR-871)

This PR changed the release gate and CI ran 36 green checks, none of which
were a scan. `publish-docker.yml` triggers only on `v*` tags, and nothing
else watched it — so the whole change would first execute at a real release.

That is the identical gap this workstream already fixed for
docker-security.yml, reintroduced one file over. Adds the release workflow to
the scan job's paths filter, with an assertion so it cannot regress.

Found by an independent close-out review.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: oblangatas

.github/workflows/docker-security.yml

@@ -12,6 +12,11 @@ on:
       # two, editing the cutoff or adding a suppression ships without ever
       # running the job it modifies. WOR-852.
       - '.github/workflows/docker-security.yml'
+      # The RELEASE gate too. publish-docker.yml only triggers on `v*` tags,
+      # so without this a change to it is exercised by nothing until a real
+      # release — WOR-871 landed its whole release-gate change on a PR with
+      # 36 green checks and zero scans among them.
+      - '.github/workflows/publish-docker.yml'
       - '.grype*.yaml'
       # NOT covered by the glob above: Actions path globs do not cross `/`.
       # grype reads this second location too, and it is the exact blind spot
@@ -38,6 +43,11 @@ on:
     paths:
       # See the push filter above — a change to the gate must exercise it.
       - '.github/workflows/docker-security.yml'
+      # The RELEASE gate too. publish-docker.yml only triggers on `v*` tags,
+      # so without this a change to it is exercised by nothing until a real
+      # release — WOR-871 landed its whole release-gate change on a PR with
+      # 36 green checks and zero scans among them.
+      - '.github/workflows/publish-docker.yml'
       - '.grype*.yaml'
       # NOT covered by the glob above: Actions path globs do not cross `/`.
       # grype reads this second location too, and it is the exact blind spot

tests/test_grype_ignore_expiry.py

@@ -248,6 +248,13 @@ def test_the_scan_reruns_when_its_own_config_changes() -> None:
         # the nested location — the same blind spot CONFIGS covers above. An
         # ignore parked there would otherwise never re-trigger the scan.
         assert ".grype/config.yaml" in paths, f"{event}: nested grype config not in paths filter"
+        # The release workflow triggers only on `v*` tags, so it is exercised
+        # by nothing on a PR unless the scan job watches it. WOR-871 shipped
+        # its entire release-gate change with 36 green checks and no scan
+        # among them; this makes that impossible to repeat.
+        assert ".github/workflows/publish-docker.yml" in paths, (
+            f"{event}: release workflow changes run no scan"
+        )
 
 
 # --- the RELEASE gate (WOR-871) --------------------------------------------