ci(416): harden docs-only detection with --no-renames (review finding)

The changed-set git diff had rename detection on by default, so a code->docs
rename (Foo.cs -> docs/Foo.md) showed only the destination and was misclassified
as docs-only, skipping required tests on a code change. --no-renames surfaces the
source deletion -> full matrix. Empirically verified. This is the cold-review
MEDIUM; it was applied in the working tree but never committed before the first
push (index/worktree mismatch) — committing it now.

Refs #416

scripts/ci-detect-docs-only.sh

@@ -72,7 +72,12 @@ case "$event" in
     ;;
 esac
 
-changed="$(git diff --name-only "$range" 2>/dev/null || true)"
+# --no-renames is load-bearing: with rename detection ON (git's default) a code->docs rename
+# (e.g. Foo.cs -> docs/Foo.md) shows ONLY the destination `docs/Foo.md`, hiding that a source file
+# left the build -> misclassified as docs-only -> required tests skipped on a code change.
+# --no-renames surfaces the deletion (`Foo.cs`, non-docs) so it correctly forces the full matrix,
+# keeping the "any code path => run everything" invariant total.
+changed="$(git diff --no-renames --name-only "$range" 2>/dev/null || true)"
 echo "Range: $range"
 echo "Changed files:"
 printf '%s\n' "$changed"