ci(perf): extend scoped test selection to non-engine, non-config backend PRs

[JSONbored]

Summary

• validate-tests' scoped vitest --changed fast path previously only applied to PRs confined to miner/mcp/discoveryIndex. Any PR touching src/** -- the majority of real contributor work -- always ran the full ~2,900+-test suite across all 3 shards, unconditionally, regardless of diff size.
• Verified this extension empirically before shipping it, given this repo already has a real precedent for a scoping mistake (chore(miner): migrate the CLI bin entry-points to TypeScript #7318-chore(miner): migrate batch 4.6 foundational lib modules to TypeScript (#7314) #7321): replayed 5 real historical single/few-file src/**-only commits spanning orb, review, api, db, and selfhost, with the target commit actually checked out (caught and fixed a methodology bug mid-analysis where an earlier pass left the worktree on main, producing a bogus 66%-selection result) and --changed run against its real parent.
  • Zero false negatives across all 5 samples -- every direct dependent test file was correctly selected every time.
  • Selection size scaled sensibly with how foundational the changed file was: a leaf module selected ~0.1% of the suite; the shared DB repositories layer selected ~31%. Always less than the unscoped 100%, never more.
  • The worst-case stress test (src/server.ts, the main entrypoint) correctly selected zero tests -- the diff sat entirely inside a /* v8 ignore */-marked block with no real test dependents, so zero was the right answer, not a miss.
• Added a new backendConfig path-filter: the subset of the existing backend filter that this verification did NOT cover and that --changed's import-graph tracing structurally can't reach anyway -- migrations, package.json/tsconfig*.json/vitest*.config.ts, and workflow/tooling files have no import-graph edge a test file could ever have to them. A PR touching any of those still gets the full unscoped suite even if it also touches src/**.
• engine and rees stay excluded exactly as before -- engine's dist/ package-boundary issue is a separately-documented, previously-reproduced real miss, unrelated to this verification.
• Confirmed live that combining --changed with an explicit positional filename narrows (intersects) the selection rather than unioning it -- so test/unit/mcp-output-schemas.test.ts (the one deliberately wide-fan-out file) is not force-included via that composition; it relies on --changed's own graph tracing, which this verification confirmed is reliable for direct same-tree imports (its exposure is via src/mcp/server.ts, a plain in-repo import chain, not a package boundary like engine's).

Safety net (unchanged)

• Every push to main still runs the full unscoped suite unconditionally -- a scoped miss in an untested corner is caught within minutes of merge, not never.
• Kill switch unchanged: the SCOPED_TEST_SELECTION_ENABLED repo variable set to "false" forces the full suite for every PR without a revert PR.

Test plan

• python3 -c "import yaml; yaml.safe_load(...)" -- ci.yml parses as valid YAML.
• git diff --stat -- single-file change, all edits confined to the changes and validate-tests jobs' scoping logic and its filter inputs.
• Verification methodology and raw results described above were run against real historical commits on this branch's base, not synthetic examples.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.56%. Comparing base (3a9450b) to head (0078fe3).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7709   +/-   ##
=======================================
  Coverage   88.56%   88.56%           
=======================================
  Files         725      725           
  Lines       76266    76266           
  Branches    22705    22705           
=======================================
  Hits        67544    67544           
  Misses       7680     7680           
  Partials     1042     1042           

Flag	Coverage Δ
rees	88.56% <ø> (ø)
shard-1	52.84% <ø> (ø)
shard-2	51.95% <ø> (ø)
shard-3	48.47% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.