CI: required "Postgres integration tests" check hangs on PRs that don't touch backend code

[manavgup]

Problem

Any PR that does not touch backend code gets permanently stuck on a required status check that reads:

Postgres integration tests — Expected — Waiting for status to be reported

The PR shows as BLOCKED and cannot be merged through the normal flow — it requires an admin bypass every time. First hit on #822 (an infra-only PR changing fly.redis.toml, scripts/fly-setup.sh, .github/workflows/deploy.yml), but it affects every docs-only or infra-only PR.

Root cause

A classic GitHub required-check + path-filter deadlock:

• Branch protection on main requires two status contexts: full-verify and Postgres integration tests (verified via repos/.../branches/main/protection/required_status_checks).
• Postgres integration tests is produced by .github/workflows/postgres-integration.yml, which is path-filtered to run only when a PR touches src/**, tests/**, pyproject.toml, uv.lock, or that workflow file.
• When a PR matches none of those paths, the workflow is skipped and never reports the Postgres integration tests context.
• Branch protection still requires that context to be reported → it waits forever. GitHub does not treat a skipped path-filtered workflow as "satisfied."

Proposed fix

Convert the workflow to the standard "always runs, skips the expensive work internally, still reports a green status" pattern, so the required context is always reported:

• Remove the paths: filter from the pull_request/push triggers so the workflow always starts.
• Add a fast change-detection gate (e.g. dorny/paths-filter pinned to a SHA, per our IaC pinning rule) as the first step.
• When no backend paths changed, short-circuit the job to success (skip the Postgres service container + test run) so the Postgres integration tests context still posts green in seconds.
• When backend paths changed, run the full Postgres integration suite exactly as today.

This keeps the gate's protective value for backend PRs while unblocking docs/infra PRs without an admin override.

Alternatives considered

• Drop it from required checks — loses the DB-compatibility gate entirely. Rejected.
• Add the relevant paths so it always triggers — would run the full Postgres suite for every README/toml change. Wasteful. Rejected.

Acceptance criteria

• An infra-only / docs-only PR shows Postgres integration tests as passed (not perpetually pending) and is mergeable without admin bypass.
• A PR touching src/** or tests/** still runs the full Postgres integration suite against the Postgres 16 service container.
• Any new action is pinned to a commit SHA (IaC supply-chain rule).

Context

• Discovered while shipping feat(infra): self-host Redis on Fly.io to replace managed Upstash (#821) #822 (self-host Redis). That PR was merged via admin bypass as a one-off.