ci(web): Workbench-only 改动未触发 Web 镜像构建

[DeliciousBuding]

Summary

Web CD does not watch the Workbench package even though app/Dockerfile copies and builds it. A Workbench-only change can pass checks and merge without producing a refreshed Web image.

Verified reproduction

• PR refactor(projects): remove misleading Hub lifecycle status filter (#2274 B-6) #2323 merged as 319bebe37425c2b20c994f952358f7c538c6185e on 2026-09-05; its entire changed-file set is under app/workbench/.
• The master checks run succeeded: https://github.com/TokenDanceLab/AgentHub/actions/runs/33954105140
• .github/workflows/cd-web.yml has no app/workbench/** entry in on.push.paths; the latest successful Web CD run remains the preceding commit a944fc0feece7915e6a967959ec136d1c73415cf: https://github.com/TokenDanceLab/AgentHub/actions/runs/33951708167
• app/Dockerfile includes COPY workbench/package.json and COPY workbench ./workbench, so this is a real build-input coverage gap, not an unused directory.

Scope / acceptance

• Cover Workbench source changes in the existing Web CD workflow's path filter; inspect the remaining declared build inputs for the same mismatch without broad CI refactoring.
• Validate the workflow with existing CI checks. Prove that a Workbench-only change selects Web CD; keep unrelated changes filtered out.
• After the fix, explicitly publish an image for the intended source revision if needed. A successful image build is not evidence of a running deployment.

Negative constraints

No product lifecycle/state-machine work, no runtime deployment, no secrets/host metadata, and no CI gate relaxation. Keep image publication and deployment as separate operations.

[DeliciousBuding]

Follow-up verification for the merged fix in #2325:

• Source: 5809d5778f7fa66f726e3b27cd593a4f1b914451. The checks run completed successfully.
• Web CD published ghcr.io/tokendancelab/agenthub-web:5809d57 at multi-architecture digest sha256:272263c3209f1557321c475a06bd141d77d5337f25c5b0ac89cc69b199c3027a.
• Hub Server CD published the same source revision at sha256:232702ca101dea5504ff536909b5ab5cb09dd2d1ca0846226ba6c3f7d211f53c.

The workflow source SHA and published digests were cross-checked against the completed job logs. The existing regression coverage remains 43 tests, including watched-input deletion and path-selection cases. This closes the image-publication follow-up; it is not a new L3 or packaged Desktop test claim.