ci: remove path filter from Windows/macOS Test so required checks always run

Windows Test + macOS Test only triggered on changes to setup.sh / drone/cli.py
/ handlers/__init__.py / pyproject.toml, but branch protection requires their
checks (windows-setup / macos-setup). On any PR not touching those paths the
workflows never ran, so GitHub parked the required checks as 'Expected —
waiting for status' forever, blocking merge — exactly what happened to PR #631
(the tests last ran + passed yesterday on the version-bump commit; tonight's
commits didn't match the filter so they never fired). The OS code is fine:
e2e-wheel's windows-latest + macos-latest passed on the same commits.

Fix: drop the paths filter; run on every push/PR to main/dev like the other
required lanes (CI/lint/coverage/security/e2e are none of them path-filtered).
A required status check must never be path-filtered or it stalls PRs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/macos-test.yml

@@ -2,19 +2,14 @@ name: macOS Test
 
 on:
   workflow_dispatch:
+  # Run on every push/PR to main/dev — NOT path-filtered. This is a branch-
+  # protection *required* check; a path filter makes it skip on unrelated PRs,
+  # which GitHub then parks as "Expected — waiting for status" forever, blocking
+  # the merge. Required checks must run on every PR to report a status.
   push:
     branches: [main, dev]
-    paths:
-      - 'setup.sh'
-      - 'src/aipass/*/apps/handlers/__init__.py'
-      - 'src/aipass/drone/cli.py'
-      - 'pyproject.toml'
   pull_request:
-    paths:
-      - 'setup.sh'
-      - 'src/aipass/*/apps/handlers/__init__.py'
-      - 'src/aipass/drone/cli.py'
-      - 'pyproject.toml'
+    branches: [main, dev]
 
 permissions:
   contents: read

.github/workflows/windows-test.yml

@@ -2,19 +2,14 @@ name: Windows Test
 
 on:
   workflow_dispatch:
+  # Run on every push/PR to main/dev — NOT path-filtered. This is a branch-
+  # protection *required* check; a path filter makes it skip on unrelated PRs,
+  # which GitHub then parks as "Expected — waiting for status" forever, blocking
+  # the merge. Required checks must run on every PR to report a status.
   push:
     branches: [main, dev]
-    paths:
-      - 'setup.sh'
-      - 'src/aipass/*/apps/handlers/__init__.py'
-      - 'src/aipass/drone/cli.py'
-      - 'pyproject.toml'
   pull_request:
-    paths:
-      - 'setup.sh'
-      - 'src/aipass/*/apps/handlers/__init__.py'
-      - 'src/aipass/drone/cli.py'
-      - 'pyproject.toml'
+    branches: [main, dev]
 
 permissions:
   contents: read

CHANGELOG.md

@@ -90,6 +90,15 @@ and this project uses [Calendar Versioning](https://calver.org/) in the format
 
 ### Fixed
 
+- **`Windows Test` / `macOS Test` are no longer path-filtered — they were
+  stalling PRs as required checks.** Both workflows only triggered when
+  `setup.sh`/`drone/cli.py`/`handlers/__init__.py`/`pyproject.toml` changed, but
+  branch protection lists `windows-setup`/`macos-setup` as *required*. On any PR
+  that didn't touch those paths the workflows never ran, so GitHub parked the
+  required checks as "Expected — waiting for status" indefinitely, blocking the
+  merge (the tests themselves were green — they simply didn't fire). They now run
+  on every push/PR to main/dev, like the other required lanes. (A required check
+  must never be path-filtered.)
 - **`seedgo-audit` CI gate was red despite 100% local audits — four checkers
   validated the working tree instead of committed source.** CI audits a clean
   `git checkout` (tracked files only — git ships no empty or gitignored dirs),