ci: let a workflow change validate itself

Adds .github/workflows/** to both path filters. A broken step, a moved
script path or a wrong runner label now fails on the commit that caused
it, instead of surfacing later against an unrelated source change and
looking like that change's fault.

This session produced exactly that bug: after the branding tools moved
under tools/, the workflow still ran `sh check-branding.sh` at the old
path, and it was caught by reading the file rather than by CI.

The limit is worth stating: this validates the job body, not the trigger
block. Break `on:` and the symptom is silence, which is indistinguishable
from success.

Workflow edits are rare enough that the extra builds cost nothing, and CI
config is the definition of how the project is built and verified — it
belongs on the source side of "source code edits only", not with the docs.

kolmekivi additionally gains the pull_request path filter the other two
already had.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WHt4DykxXaQnyaJfyS8KCn

.github/workflows/ci.yaml

@@ -10,6 +10,12 @@ on:
       - 'Cargo.lock'
       - 'bundler.toml'
       - 'tools/**'
+      # This workflow validates itself: a broken step, a moved script path or a
+      # wrong runner label then fails loudly on the commit that caused it, rather
+      # than surfacing later against an unrelated source change. Note the limit -
+      # it checks the job body, not the trigger block above. Break `on:` and the
+      # symptom is silence, which looks like success.
+      - '.github/workflows/**'
   # Mirrors the push filter. Without it a PR touching only the README would run a
   # full build - the branch filter alone constrains where, not what.
   pull_request:
@@ -21,6 +27,7 @@ on:
       - 'Cargo.lock'
       - 'bundler.toml'
       - 'tools/**'
+      - '.github/workflows/**'
   workflow_dispatch:
 
 # Target the self-hosted Rust/audio runner registered to the `musiikki` org.