CI: skip Internal Tests dispatch for docs-only changes (#4995)

## Summary

- Add a `dorny/paths-filter` step to the `internal-tests` job that
checks for any changed file outside `docs/`.
- Gate the private-repo dispatch and the wait-for-completion steps on
that filter, so a docs-only PR no longer fires off the private CI
workflow.
- The job itself still runs and completes successfully, so any branch
protection requiring the `Internal Tests` check continues to be
satisfied.

## Test plan

- [ ] Open a docs-only follow-up PR and confirm `Internal Tests` reports
success without dispatching a private run.
- [ ] Open a PR touching `crates/` (or anything non-docs) and confirm
the private dispatch still fires as before.

Author: cloutiertyler

.github/workflows/ci.yml

@@ -887,13 +887,26 @@ jobs:
       && (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) }}
     permissions:
       contents: read
+      pull-requests: read
     runs-on: ubuntu-latest
     env:
       TARGET_OWNER: clockworklabs
       TARGET_REPO: SpacetimeDBPrivate
     steps:
+      # Skip the private dispatch entirely when only `docs/` is touched. The job
+      # itself still completes successfully so required-status-check gating is
+      # satisfied without spending private-runner time on a docs-only change.
+      - name: Detect non-docs changes
+        id: filter
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            non_docs:
+              - '!docs/**'
+
       - id: dispatch
         name: Trigger tests
+        if: steps.filter.outputs.non_docs == 'true'
         uses: actions/github-script@v7
         with:
           github-token: ${{ secrets.SPACETIMEDB_PRIVATE_TOKEN }}
@@ -957,6 +970,7 @@ jobs:
             core.setOutput('run_url', runUrl);
 
       - name: Wait for Internal Tests to complete
+        if: steps.filter.outputs.non_docs == 'true'
         uses: actions/github-script@v7
         with:
           github-token: ${{ secrets.SPACETIMEDB_PRIVATE_TOKEN }}
@@ -994,7 +1008,7 @@ jobs:
             }
 
       - name: Cancel invoked run if workflow cancelled
-        if: ${{ cancelled() }}
+        if: ${{ cancelled() && steps.dispatch.outputs.run_id }}
         uses: actions/github-script@v7
         with:
           github-token: ${{ secrets.SPACETIMEDB_PRIVATE_TOKEN }}