The full BrowserStack e2e (build Android + iOS, upload, run on real
devices — ~15-25 min of paid device time) ran on every PR, including
ones that can't affect runtime behaviour (dependabot.yml, pr-title.yml,
docs, *.md). Path-filtering the trigger can't fix this on its own: a
workflow skipped by `paths` never reports its required checks, which
leaves the PR stuck pending.

Instead, detect changed paths inside the reusable workflow and collapse
the five nested required checks into one always-reporting gate:

- New `changes` job classifies the PR's files (via actions/github-script,
  already used in pr-title.yml — read-only file listing, no checkout, so
  it's safe on the pull_request_target path). Config/docs-only => skip;
  code, package*.json, or a change to the e2e machinery itself => run.
  merge_group and workflow_dispatch always run. Defaults to running on
  any uncertainty.
- The build/upload/test jobs are gated on that result; downstream jobs
  cascade-skip.
- A new `gate` job (needs: [everything], if: always()) passes when e2e
  was legitimately skipped or every job succeeded, and fails closed on
  any failure/cancel or a path-detection error. Its context, `e2e / Gate`,
  is meant to replace the five nested e2e checks as the required one.

Lives in the reusable workflow so both callers (e2e-tests.yml and the
label-gated e2e-trusted.yml) honour the skip from one definition. The
trust model is unchanged: untrusted PRs still leave `e2e / Gate` absent
(not skipped-as-passing) until a maintainer adds `safe-to-test`.

Requires a follow-up ruleset change (admin-only): swap the five
`e2e / Build|Run tests|Upload …` required checks for `e2e / Gate`.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Now that `e2e / Gate` always reports on both `pull_request` and
`merge_group`, defer the expensive BrowserStack run to where it matters:
the merge queue, which is the enforced merge path (the ruleset's
merge_queue rule builds each PR individually before it lands).

Decision (all in the `changes` job):
- merge_group: run, unless the merge group is docs/config-only.
- workflow_dispatch: run (explicit manual request).
- pull_request: defer to the queue by default; run only if the PR
  carries the `run-e2e` label (added `labeled` to the PR triggers).
- pull_request_target: unchanged — runs once a maintainer adds
  `safe-to-test`, still skipping docs/config-only diffs.

On a plain PR the gate still passes cheaply (heavy jobs skipped), so the
PR stays mergeable with no paid device time; the real run happens in the
queue and ejects the PR if it fails. Devs who touch device-facing code
can add `run-e2e` (or dispatch) for pre-queue feedback.

merge_group has no PR file list, so its diff comes from comparing the
group's base_sha...head_sha.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The three jobs that take >5 min — Instrumented Tests (10m), Integration
Tests (9m), iOS Device Build (7m) — ran on every PR push. Gate them on
the same merge-queue-first decision as the e2e suite: run in the merge
queue (the pre-merge gate), on manual dispatch, or on a PR labeled
`run-e2e`; skip on a plain PR and for docs/config-only changes.

A shared `detect-heavy-ci.yml` reusable workflow makes the decision so
the Android and iOS workflows share one copy (the e2e suite keeps its
own inline `changes` job — its self-test machinery paths differ). On a
plain PR the heavy jobs report as `skipped`, which satisfies the
required status checks without running them; the real run happens in the
queue and ejects the PR if it fails. The fast JVM-unit and Swift-package
jobs stay on every PR for quick feedback.

No ruleset change needed: the check names are unchanged and a skipped
required check counts as passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

… reports

A matrix job skipped by a job-level `if` reports its check run under the
bare job name (`Instrumented Tests`), without the matrix suffix — so the
required `Instrumented Tests (30)` context never reported and the PR hung
on "Expected — Waiting for status to be reported".

The matrix held a single value (api-level 30), so replace it with the
literal name `Instrumented Tests (30)` and a hardcoded api-level. A plain
(non-matrix) job reports the exact context name as `skipped` when gated
out, which satisfies the required check — matching the iOS heavy jobs,
which already skip-as-passing correctly. No ruleset change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>