ci(web): 补齐镜像构建输入触发与回归保护

[DeliciousBuding]

Summary

• Include Workbench source and the pnpm workspace manifest in Web CD push paths, matching the reviewed Docker build inputs.
• Extend the existing CI policy verifier and its self-tests: deleting any of the eight watched inputs fails; Workbench-only changes select Web CD while unrelated packages/docs remain filtered.
• Clarify image publication versus runtime deployment in the CI/CD owner document.

Closes #2324

Validation

• python scripts/verify/verify-ci-gates.py — passed
• python scripts/verify/tests/verify-ci-gates.Tests.py — 43 tests passed (including eight input-deletion mutations and nine path-selection cases)
• python scripts/verify/verify-doc-ssot.py — passed
• YAML parse: Web CD, checks workflow, OpenAPI — passed
• git diff --check — passed

Boundaries

CI/configuration only; no product/runtime changes. No new L3 or packaged Desktop evidence (real_tested=false for this change). Image publication will be checked separately after merge; publication is not deployment.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: f34a55d5-da2f-4648-b47c-637dda279c2c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}