ci(docs): pin path-filter / required-checks rationale at the source

dudect.yml is path-filtered to src/c/**, include/**, tests/c/test_dudect.c,
tests/c/dudect/**. PRs that don't touch C source (e.g. workflow-only or
docs-only changes) don't trigger the workflow, so its 4 job names never
emit a status check on those PRs. Adding any of the 4 to the `main`
branch's required-status-check ruleset would block every unrelated PR
with "Expected -- Waiting for status to be reported" indefinitely. Same
class of trapdoor as `baseline-guard.yml::Enforce baseline.json
justification` and `wiki-sync.yml::sync-wiki`, both of which the PR #289
description already correctly excludes from the required cohort.

Document the rationale in-tree at the top of all three path-filtered
workflows so a future maintainer touching the rulesest doesn't have to
re-derive it from PR #289 archaeology. The note explicitly cross-
references each peer file and the canonical exclusion list.

Behavioural change: none. Header comment additions only.

Author: claude

.github/workflows/baseline-guard.yml

@@ -9,6 +9,15 @@
 # an identifier for the CI runner on which the measurement was taken.
 # See benchmarks/check_baseline_justification.py for the full contract
 # and docs/BENCHMARK_HISTORY.md for the motivating history.
+#
+# RULESET / REQUIRED-CHECKS NOTE: this workflow is path-filtered to PRs
+# touching `benchmarks/baseline.json`, so its 'Enforce baseline.json
+# justification' job does NOT emit on unrelated PRs. Do NOT list this
+# job in the `main` branch's required-status-check ruleset — it would
+# block every PR that doesn't touch baseline.json with 'Expected —
+# Waiting for status to be reported'. Same reasoning as `dudect.yml`
+# and the wiki-sync job; see PR #289 'Deliberately not included' for
+# the canonical exclusion list.
 
 name: Baseline.json Change Guard
 

.github/workflows/dudect.yml

@@ -1,5 +1,26 @@
 name: CI - dudect Constant-Time Verification
 
+# RULESET / REQUIRED-CHECKS NOTE
+# ------------------------------
+# This workflow is path-filtered to PRs that touch C source / dudect
+# harness code (see `paths:` blocks below). PRs that don't touch any of
+# those paths will NOT trigger this workflow, so its 4 job names
+# ('dudect - Utility Functions', 'dudect - PQC Primitives',
+#  'dudect - Legacy Harnesses (tools/constant_time)',
+#  'dudect - X25519 AVX2 4-way (opt-in)') do NOT emit a status check on
+# such PRs.
+#
+# Consequence for branch rulesets: do NOT add these 4 names to the
+# `main` branch's required-status-check list. A required check that is
+# never reported on path-filtered PRs blocks merge indefinitely with
+# 'Expected — Waiting for status to be reported'. Same reasoning as
+# `baseline-guard.yml::Enforce baseline.json justification` and the
+# wiki-sync job — see PR #289 description ('Deliberately not included')
+# for the canonical exclusion list.
+#
+# The dudect gate still fails closed when it DOES run (no
+# `continue-on-error`, no silent skips inside the harness), which is the
+# regression case it exists to catch.
 on:
   push:
     branches: [ main, develop, 'feature/**' ]

.github/workflows/wiki-sync.yml

@@ -1,5 +1,11 @@
 name: Sync Wiki
 
+# RULESET / REQUIRED-CHECKS NOTE: this workflow only fires on push to
+# `main` with `wiki/**` changes. The `sync-wiki` job is documentation
+# publishing, not correctness, so it must NOT be added to the
+# required-status-check ruleset on `main`. Same exclusion class as
+# `dudect.yml` and `baseline-guard.yml`; see PR #289 'Deliberately not
+# included' for the canonical list.
 on:
   push:
     branches: