[WilcoLouwerse]

Summary

Since #881, a push run's changed-path filter diffs from the head of the last push run that finished uncancelled, and it reads that with gh api and $BRANCH. scripts/test-changed-path-filter.py runs the push cases with neither. set -u stops the script on the unbound BRANCH (rc=127), so the docs-only and src/ push cases fail on main. That turns the required Shared-workflow guard red on every open PR in this repo.

The workflow is fine; only the suite's environment is incomplete:

• A fake gh on PATH answers the two Actions API calls offline. Its FAKE_GH_LAST is the head it reports, and FAKE_GH_FAIL makes every call fail.
• The push env now carries BRANCH, GITHUB_REPOSITORY and GITHUB_RUN_ID.
• Two new cases cover what fix(quality): diff a push from the last finished run, not from the previous tip #881 added:
  • a docs-only push after a cancelled code push must run the test tier;
  • a push whose last finished run cannot be read must run everything.

Test plan

• python3 scripts/test-changed-path-filter.py .github/workflows/quality.yml → 16/16 passed (main: 3 failed)
• --positive-control → the control still fires
• Against the workflow from before fix(quality): diff a push from the last finished run, not from the previous tip #881, the two new cases fail (14/16), so they exercise the new path rather than passing by accident

🤖 Generated with Claude Code

[WilcoLouwerse]

@rjzondervan @remko48 @bbrands02 @SudoThijn could one of you force-merge this PR? I am not allowed to bypass the branch protection myself. Ruben is restructuring the branches tonight and this weekend, so I want this on main today; then I can still merge the beta release PRs before that.